Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-113169: Chrome for Android may display fake install prompts

CVE-2026-113169 · published 15 days ago

Summary

On Android versions of Google Chrome before version 156.0.8078.47, a malicious app installed on the same device could make Chrome show deceptive user‑interface elements that look like legitimate web‑app install dialogs. This could trick users into approving actions they did not intend. Update Chrome to the latest version to stop the spoofing.

What to do

Update debian chromium to version 156.0.8078.47-1~deb12u1.
Update debian chromium to version 156.0.8078.47-1~deb13u1.
Update debian chromium to version 156.0.8078.47-1.
Update google chrome to version 156.0.8078.47 or later.

Affected software

Ecosystem	Vendor	Product	Affected versions
–	google	chrome	< 156.0.8078.47
Debian:12	debian	chromium	< 156.0.8078.47-1~deb12u1 Fix: upgrade to 156.0.8078.47-1~deb12u1
Debian:13	debian	chromium	< 156.0.8078.47-1~deb13u1 Fix: upgrade to 156.0.8078.47-1~deb13u1
Debian:14	debian	chromium	< 156.0.8078.47-1 Fix: upgrade to 156.0.8078.47-1

Original advisory text

UI misrepresentation in WebAppInstalls in Google Chrome on on Android prior to 156.0.8078.47 allowed a local attacker leveraging social engineering to spoof UI elements via a co-installed app. (Chr...

References

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker full control

Severity

9.6 Critical

Exploitation

<1% chance of attack within 30 days

Type

CWE-119Buffer Overflow

CWE-451User Interface (UI) Misrepresentation of Critical Information

Timeline

Published20 Oct 2026

Updated4 Nov 2026

First seen20 Oct 2026

Sources

CVE-2026-113169 · NVD

CVE-2026-113169 · MITRE

DEBIAN-CVE-2026-113169 · OSV

Track software like this

Free during beta