CVE-2026-91723 Overview
CVE-2026-91723 is a race condition vulnerability in the WebAppInstalls component of Google Chrome prior to version 153.0.8010.47. A remote attacker can exploit this flaw using a crafted HTML page to spoof user interface (UI) elements in the browser. Chromium security has rated the underlying issue as Medium severity. The weakness is classified under CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization. Successful exploitation can mislead users into trusting attacker-controlled content presented through legitimate-looking browser UI, enabling downstream phishing and social-engineering attacks against Chrome desktop users.
Critical Impact
Remote attackers can spoof Chrome UI elements through crafted web pages, undermining the visual trust boundary users rely on to distinguish browser chrome from web content.
Affected Products
- Google Chrome desktop versions prior to 153.0.8010.47
- Chromium-based browsers incorporating the vulnerable WebAppInstalls code path
- Progressive Web App (PWA) install workflows exposed through Chrome
Discovery Timeline
- 2026-09-15 - CVE-2026-91723 published to NVD
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-91723
Vulnerability Analysis
The vulnerability resides in the WebAppInstalls subsystem of Chrome, which handles installation prompts and lifecycle events for web applications and PWAs. A race condition [CWE-362] between the rendering of install-related UI and the underlying page state allows a crafted HTML page to influence what the browser displays at a critical timing window. Because install prompts, permission dialogs, and related surfaces sit within trusted browser chrome, spoofing them can convince users that attacker content originates from Chrome itself or from a trusted origin.
Root Cause
The root cause is improper synchronization between concurrent operations that update WebAppInstalls UI state and the associated page context. When two events race, the UI element can be rendered against stale or attacker-controlled data. This class of defect enables the attacker to substitute origin indicators, install prompts, or related visual elements without violating the same-origin policy at the network layer.
Attack Vector
Exploitation requires the victim to visit a crafted HTML page in an unpatched Chrome build. The attacker triggers install-related flows and races them against navigation or DOM updates to produce a spoofed UI state. No authentication is required, and interaction is limited to normal browsing behavior. Technical specifics are tracked in the restricted Chromium Issue Tracker #474131239 and summarized in the Google Chrome Stable Update advisory.
No public proof-of-concept code has been released. The EPSS probability is 0.172% (percentile 6.866) as of 2026-09-16, indicating low near-term exploitation likelihood.
Detection Methods for CVE-2026-91723
Indicators of Compromise
- Chrome desktop endpoints reporting version strings earlier than 153.0.8010.47 in inventory telemetry.
- Browser navigation to unfamiliar domains immediately followed by PWA install prompts or credential entry.
- User reports of install dialogs or origin indicators that do not match the expected site.
Detection Strategies
- Query endpoint inventory for installed Chrome versions and flag hosts running builds prior to 153.0.8010.47.
- Correlate web proxy logs with browser process telemetry to identify sessions where PWA install events occur on low-reputation domains.
- Monitor for anomalous chrome.exe child processes or shortcut creation associated with newly installed web apps from untrusted origins.
Monitoring Recommendations
- Ingest browser and endpoint telemetry into a centralized data lake to enable version-based hunting across the fleet.
- Track PWA installation events and shortcut creation from user-writable directories such as %LOCALAPPDATA%\Google\Chrome\User Data\Default\Web Applications\.
- Alert on phishing indicators such as credential submissions to domains registered within the last 30 days following an install prompt.
How to Mitigate CVE-2026-91723
Immediate Actions Required
- Update Google Chrome to version 153.0.8010.47 or later on all desktop endpoints.
- Restart the Chrome browser after update deployment to ensure the patched binary is loaded.
- Verify Chromium-based browsers (Edge, Brave, Opera, Vivaldi) have absorbed the upstream fix in their next release cycle.
Patch Information
Google released the fix in the Chrome Stable channel update documented in the Google Chrome Stable Update advisory. Enterprises using managed Chrome deployments should push the update through Google Update, SCCM, Intune, or their MDM of choice. The vendor patch is the authoritative remediation; no upstream configuration flag mitigates the race condition itself.
Workarounds
- Disable PWA installation via the WebAppInstallForceList and DefaultWebAppInstallAllowed enterprise policies until patching completes.
- Restrict browsing to trusted origins through URL allowlists on high-value user groups such as finance and executives.
- Train users to verify install prompts against the address bar origin and to reject unexpected PWA install dialogs.
# Configuration example: Chrome enterprise policy to suppress PWA installs during rollout
# Windows registry (HKLM) equivalent of the Chrome ADMX policy
reg add "HKLM\Software\Policies\Google\Chrome" /v DefaultWebAppInstallAllowed /t REG_DWORD /d 0 /f
# macOS managed preference
defaults write com.google.Chrome DefaultWebAppInstallAllowed -bool false
# Verify Chrome version meets the patched baseline
google-chrome --version | awk '{print $3}'
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
