Google Play Hosted Fake Chrome App With 100,000+ Downloads

A counterfeit Google Chrome app published by Hizbartech appeared on Google Play with 100,000+ downloads and secured sponsored placement above the legitimate browser.

First reported on October 14, 2026, the listing copied Chrome’s recognizable icon and description, exploiting both brand familiarity and paid visibility to attract users.

Subsequent reporting indicates Google removed the application, although the incident raises questions about impersonation checks across app listings and advertising.

The discovery surfaced in the r/browsers community, where a user shared a screenshot showing the sponsored counterfeit above an already installed Chrome application.

The impersonator displayed the developer name Hizbartech, a 42 MB download size, and a three-plus age rating. Its prominent install button and familiar branding made the publisher name an important distinguishing detail.

PiunikaWeb reported that searching for “Google Chrome” ,did not consistently reproduce the sponsored placement, but searching for Hizbartech exposed the listing. A separate r/chrome discussion encouraged users to flag the copycat.

These observations establish that the application was discoverable through Google Play, but do not reveal how widely its advertisement circulated or how many installations came directly from paid promotion.

The application retained the package identifier com. ballbounce.Hizbartech, linking its Chrome branding to an earlier identity.

Fake Chrome App on Google Play

According to reporting Google Play and APKPure records, the app initially appeared as Ball Bounce in August before adopting Chrome’s name and icon in late September.

Android Authority identified August 22 as its original appearance and September 30 as the rebranding date.

This impersonation illustrates a listing-level bait-and-switch: an existing application changes its outward identity while retaining its package and accumulated distribution history.

Consequently, the 100,000+ figure should not automatically be interpreted as 100,000 users downloading the counterfeit Chrome version documented, reddit said.

Users who reportedly installed the application found something substantially different from a browser.

Accounts described an interface featuring AI avatars or chat functionality rather than a Chromium-based browsing experience.

Those observations support the deceptive-functionality allegation, but they are not a substitute for independent analysis of the APK, its permissions, network traffic, or embedded advertising components.

The available evidence establishes misleading branding, not confirmed credential theft or spyware functionality.

Reports have characterized the application as adware, but the cited material does not provide a malware sample analysis demonstrating information stealing, persistence, or command-and-control infrastructure.

Treating those capabilities as established would overstate the findings.

The case nevertheless connects to broader browser-trust abuse. Separate reporting describes 19 Chrome and Edge extensions linked to malicious payload delivery, credential theft, cryptocurrency wallet attacks, and fake browser-update lures.

That campaign provides relevant context for how familiar browser interfaces and previously legitimate software can become distribution vehicles; it does not establish shared operators or infrastructure with Hizbartech.

Google’s impersonation policy explicitly prohibits misleading app identities, unauthorized brand associations, and deceptive icons, titles, or descriptions.

Users evaluating Chrome listings should verify the publisher rather than trust sponsored placement or download totals.

The central lesson is that storefront presence and advertising visibility cannot independently establish authenticity, particularly when an application’s branding changes after publication.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.