CVE-2026-121046 in Chrome
Summary
by MITRE • 11/03/2026
Incorrect authorization in WebAppInstalls in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof address bar via a crafted HTML page. (Chromium security severity: Low)
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 11/03/2026
The vulnerability identified as an incorrect authorization issue within the WebAppInstalls component of Google Chrome prior to version 157.0.8103.38 represents a significant breach in browser-level trust boundaries, specifically targeting the mechanism by which web applications are installed and presented to users. This flaw stems from improper validation or enforcement of access controls during the installation process for Progressive Web Apps (PWAs) or other web-based application interfaces embedded within the Chromium engine. The core technical deficiency lies in the failure to strictly verify that the origin requesting the installation possesses legitimate authority over the resources being registered, allowing a malicious actor to manipulate the browser's internal state through crafted HTML content. By exploiting this logic error, an attacker can bypass standard security checks that normally prevent unauthorized entities from altering how applications are displayed or accessed within the user environment.
The operational impact of this vulnerability is primarily centered around address bar spoofing and identity confusion for end-users. When a remote attacker leverages social engineering techniques to lure a victim into visiting a specially crafted HTML page, they can exploit the authorization flaw to manipulate the browser's UI elements. Specifically, the attacker can cause the address bar or application title to display misleading information that does not accurately reflect the true origin of the content being rendered. This discrepancy creates a deceptive user interface where the visual cues suggest legitimacy while the underlying network request originates from a malicious source. Such spoofing is particularly dangerous because it undermines one of the primary defenses against phishing attacks: the ability of users to visually verify the domain they are interacting with, thereby facilitating credential theft or further malware distribution under the guise of a trusted entity.
From a classification perspective, this vulnerability aligns closely with CWE-269, which denotes Improper Privilege Control, as it involves an actor gaining capabilities beyond what is intended by the system's security architecture. Furthermore, the technique employed to deceive users through UI manipulation corresponds directly to MITRE ATT&CK tactic T1036, known as Masquerading. The specific sub-technique of spoofing interface elements like address bars falls under methods designed to bypass user awareness and trust mechanisms. By presenting a fake identity for the web application, the attacker effectively masks their malicious intent behind a facade of legitimacy, exploiting human psychology rather than solely relying on technical exploitation vectors. This highlights the critical intersection between software security flaws and social engineering effectiveness in modern threat landscapes.
Mitigation strategies must focus on both immediate patching and long-term architectural improvements to prevent similar authorization bypasses. The primary remediation is to update Google Chrome to version 157.0.8103.38 or later, where the Chromium team has addressed the logic errors in the WebAppInstalls component that allowed for this unauthorized manipulation. Beyond patching, developers and security teams should enforce strict Content Security Policies (CSP) to limit how scripts can interact with browser UI elements and restrict frame nesting behaviors that could facilitate spoofing attempts. Additionally, user education remains vital; organizations should train employees to scrutinize address bars carefully before entering sensitive information, recognizing that visual cues alone are not sufficient proof of authenticity when sophisticated social engineering is involved. Regular security audits focusing on privilege escalation paths in web application installation flows can also help identify and rectify similar authorization weaknesses before they are exploited by adversaries.