Description
UI misrepresentation in WebAppInstalls in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)
Published: 2026-10-06
Score: 5.4 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized Access
Action: Apply Patch
AI Analysis

Impact

The vulnerability exposes a UI misrepresentation in Chrome’s WebAppInstalls prior to version 155.0.8059.39, enabling a remote attacker to trick users into installing content that bypasses system access restrictions. This flaw does not provide remote code execution but allows unauthorized elevation of privileges through social engineering, as described by CWE-451.

Affected Systems

The issue affects all users of Google Chrome desktop releases earlier than 155.0.8059.39; any installation of those versions that allows Web App Installs is vulnerable.

Risk and Exploitability

Exploitability relies on an attacker delivering a crafted HTML page and convincing a user to interact with it. EPSS data is unavailable and the vulnerability is not in CISA KEV, suggesting a low probability of widespread exploitation. The CVSS score of 5.4 indicates a low to moderate severity. Users should still patch promptly to avoid potential privilege escalation.

Generated by OpenCVE AI on October 7, 2026 at 00:39 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Chrome to version 155.0.8059.39 or later on all affected systems.
  • If an immediate upgrade is not possible, temporarily disable the Web App Installs feature using Chrome enterprise policies to block unwanted installations.
  • Educate users to verify the source of web apps before installation and avoid interacting with suspicious prompts.

Generated by OpenCVE AI on October 7, 2026 at 00:39 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4833-1 chromium security update
Debian DSA Debian DSA DSA-6553-1 chromium security update
History

Sat, 10 Oct 2026 00:30:00 +0000

Type Values Removed Values Added
Title UI Misrepresentation in Chrome Web App Installs Allows Social Engineering to Bypass Access Restrictions chromium-browser: UI misrepresentation in WebAppInstalls
References
Metrics threat_severity

None

 threat_severity

Low

Wed, 07 Oct 2026 14:00:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*

Wed, 07 Oct 2026 03:15:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Wed, 07 Oct 2026 01:00:00 +0000

Type Values Removed Values Added
Title UI Misrepresentation in Chrome Web App Installs Allows Social Engineering to Bypass Access Restrictions

Tue, 06 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 06 Oct 2026 19:00:00 +0000

Type Values Removed Values Added
Description UI misrepresentation in WebAppInstalls in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)
Weaknesses CWE-451
References

Subscriptions

Google Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-10-06T20:45:57.300Z

Reserved: 2026-10-06T16:34:19.485Z

Link: CVE-2026-106285

cve-icon Vulnrichment

Updated: 2026-10-06T20:43:20.559Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-06T19:17:56.280

Modified: 2026-10-07T13:43:43.640

Link: CVE-2026-106285

cve-icon Redhat

Severity : Low

Publid Date: 2026-10-06T18:41:38Z

Links: CVE-2026-106285 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-07T03:00:11Z

Weaknesses
  • CWE-451

    User Interface (UI) Misrepresentation of Critical Information