CVE-2026-79173 in Chrome
Summary
by MITRE • 08/26/2026
UI misrepresentation in WebAppInstalls in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/26/2026
The vulnerability identified as a user interface misrepresentation within the WebAppInstalls component of Google Chrome prior to version 152.0.7977.65 represents a significant trust boundary violation that exploits the browser's native application installation workflow. This flaw allows a remote attacker, through the delivery of a specially crafted HTML page, to manipulate or spoof user interface elements associated with web app installations. By leveraging this discrepancy between what is displayed to the end-user and the actual system actions being performed, an adversary can deceive users into believing they are interacting with legitimate browser prompts while actually authorizing potentially malicious operations. This type of attack falls squarely under the category of UI redressing or clickjacking variants where the integrity of the user interface is compromised to facilitate social engineering attacks rather than direct code execution vulnerabilities.
From a technical perspective, this issue stems from improper handling of state and presentation logic within the Chromium engine's web application installation module. When a website attempts to trigger an install prompt for a Progressive Web App or similar web-based application, the browser generates specific UI dialogs that inform the user about permissions being requested by the site. In vulnerable versions, these prompts could be manipulated via crafted HTML content to display misleading information, such as false permission requests or altered installation targets. This misrepresentation breaks the fundamental security model of browsers which rely on users accurately interpreting system-generated warnings before granting elevated privileges like offline access, push notifications, or home screen shortcuts. The severity is classified as medium because while it does not allow direct arbitrary code execution, it serves as a powerful vector for phishing and credential harvesting by masking malicious intent behind legitimate-looking browser interfaces.
The operational impact of this vulnerability centers on the erosion of user trust and potential data compromise through deception. An attacker hosting or linking to the crafted HTML page can trick users into installing web apps that may subsequently engage in unauthorized background activities, such as sending push notifications containing phishing links or accessing sensitive local storage without clear consent. Furthermore, if the spoofed UI mimics system-level dialogs for permissions like camera or microphone access, it could lead to privacy violations where users unknowingly grant surveillance capabilities to malicious scripts. This aligns with common attack patterns observed in modern web exploitation campaigns that prioritize social engineering over technical exploits due to increasing browser security hardening against traditional injection attacks.
This vulnerability maps directly to CWE-201: Insertion of Sensitive Information into Sent Data, specifically regarding the manipulation of user-facing information elements, and is closely related to CWE-836: Use of Password-Based Authentication in a Context that Lacks Protection Against Replay Attacks if used for credential harvesting via spoofed login prompts. In terms of offensive security frameworks, it corresponds to MITRE ATT&CK technique T1059 Command and Scripting Interpreter within the context of web-based execution or more accurately T1621 Multi-Factor Authentication Interception where UI manipulation is used to bypass user awareness controls. The attack vector requires no special privileges for the attacker but does require successful social engineering to get a victim to visit the malicious page, classifying it as an external threat with low complexity in terms of exploitation requirements but high impact on confidentiality and integrity due to the deceptive nature.
Mitigation strategies primarily involve immediate patching to version 152.0.7977.65 or later where these UI rendering inconsistencies have been resolved by Chromium developers through stricter validation of prompt parameters and enhanced separation between user input and system-generated dialog content. Organizations should ensure that endpoint protection solutions are updated to detect unusual patterns in web app installation requests, particularly those originating from untrusted domains. User education remains critical; administrators must emphasize the importance of verifying the domain name displayed in browser prompts before confirming any installation or permission grants. Additionally, implementing Content Security Policy headers can help restrict which origins are allowed to trigger install events, thereby reducing the attack surface available to remote attackers attempting to exploit this UI misrepresentation flaw. Regular auditing of web application deployment practices and monitoring for anomalous behavior related to service worker registrations will further strengthen defenses against such deceptive tactics.