CVE-2026-93386

CVE-2026-93386 is a UI misrepresentation flaw (CWE-451) in the WebAppInstalls component of Google Chrome, allowing a remote attacker to spoof UI elements through a specially crafted HTML page. The attack is triggered via social engineering: a user must be lured into opening the crafted page, which then presents misleading interface elements, such as a deceptive web-app install prompt or dialog content. Successful spoofing could make fake prompts or dialogs appear trustworthy, tricking users into actions or beliefs that aid a phishing-style deception. All users running Google Chrome versions prior to 153.0.8010.52 are affected, and the flaw was rated Low severity by Chromium maintainers. There is no evidence of exploitation in the wild, no public proof-of-concept, and the issue is not listed in CISA's KEV catalog; it was patched in the Chrome 153.0.8010.52 release, which fixed 16 security issues.

What to do: Update Google Chrome to version 153.0.8010.52 or later on all desktop platforms (check chrome://settings/help and restart the browser to confirm the update is applied), since Chrome normally auto-updates but may need a restart. As an interim mitigation, treat unexpected web-app install prompts with suspicion and avoid granting install or permission requests from untrusted pages. Monitor the dashboard for any addition to CISA KEV or emergence of a public proof-of-concept.