Description
UI misrepresentation in WebAppInstalls in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)
Published: 2026-10-06
Score: 5.4 Medium
EPSS: < 1% Very Low
KEV: No
Impact: UI Spoofing / Clickjacking
Action: Patch Update
AI Analysis

Impact

UI misrepresentation in WebApp Installs allows a remote attacker to craft a simple HTML page that mimics Chrome’s native UI. The malicious page can display elements that appear to be official prompts or controls, potentially tricking users into clicking actions they did not intend. Chromium categorizes the flaw as low severity because it does not provide a direct path to code execution, data theft, or system compromise.

Affected Systems

All desktop builds of Google Chrome versions earlier than 155.0.8059.39 are affected. The vulnerability resides in the WebApp Installs feature and is present across all supported desktop operating systems for those releases.

Risk and Exploitability

The attack function requires only that a user open a crafted web page; no special privileges, additional software, or exploitation of another vulnerability are necessary. EPSS data is not available, the flaw is not listed in CISA’s KEV catalog, and a CVSS score of 5.4. The recognized low severity suggests the impact is limited to UI deception, but upgrading the browser remains the recommended response.

Generated by OpenCVE AI on October 7, 2026 at 00:37 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Google Chrome to version 155.0.8059.39 or later
  • Enable automatic updates for Chrome to receive future security patches
  • Limit installation of web apps to trusted sites or disable the WebApp Installs feature if possible

Generated by OpenCVE AI on October 7, 2026 at 00:37 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4833-1 chromium security update
Debian DSA Debian DSA DSA-6553-1 chromium security update
History

Thu, 08 Oct 2026 13:00:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*

Wed, 07 Oct 2026 12:30:00 +0000

Type Values Removed Values Added
Title chromium-browser: UI misrepresentation in WebAppInstalls
References
Metrics threat_severity

None

 threat_severity

Low

Wed, 07 Oct 2026 01:45:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Wed, 07 Oct 2026 01:00:00 +0000

Type Values Removed Values Added
Title Chrome UI Spoofing Vulnerability via WebAppInstalls

Tue, 06 Oct 2026 22:00:00 +0000

Type Values Removed Values Added
Title Chrome UI Spoofing Vulnerability via WebAppInstalls

Tue, 06 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 06 Oct 2026 19:00:00 +0000

Type Values Removed Values Added
Description UI misrepresentation in WebAppInstalls in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)
Weaknesses CWE-451
References

Subscriptions

Google Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-10-06T20:45:57.054Z

Reserved: 2026-10-06T16:30:00.433Z

Link: CVE-2026-106179

cve-icon Vulnrichment

Updated: 2026-10-06T20:43:16.522Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-06T19:17:43.807

Modified: 2026-10-08T13:05:59.020

Link: CVE-2026-106179

cve-icon Redhat

Severity : Low

Publid Date: 2026-10-06T18:41:39Z

Links: CVE-2026-106179 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-07T01:30:09Z

Weaknesses
  • CWE-451

    User Interface (UI) Misrepresentation of Critical Information