Talk to an expert
PricingNewsTalk to an expert
Back to Newsroom
Threat Intel

Fake "Google Chrome" on Google Play: A Rebranded Game Reached the Top of Search

A Play Store listing by "Hizbartech" copied Chrome's name and icon, showed 100K+ downloads and reportedly ran as a sponsored result. It was a rebranded game, not a browser. Here is what's confirmed, what isn't, and how to check your devices.

4T4Tify Team4Tify
Oct 15, 2026·5 min read
Fake "Google Chrome" on Google Play: A Rebranded Game Reached the Top of Search

Fake "Google Chrome" Listing on Google Play: What We Know and What We Don't

A Google Play listing calling itself Google Chrome, with Chrome's name, icon and store description, was spotted by Android users this week. It was published by a little-known developer, Hizbartech, not Google LLC. Users say it showed up as a sponsored result above the real browser when they searched for "Chrome". The listing showed a 100K+ downloads badge, which made it look trustworthy at a glance.

This is a clear case of brand impersonation on an official app store. The public evidence does not show that it delivered malware. Both points matter.

What happened

  • The listing. Name, icon and description copied from Chrome; publisher "Hizbartech"; size about 42 MB; flagged as "in development / Early Access" and filed under Communication, not as a browser.
  • How it was found. A member of Reddit's r/browsers community posted a screenshot of the sponsored placement. Android-focused outlets then looked into it. One of them could find the listing by searching for the developer's name but could not reproduce the sponsored Chrome result itself.
  • A changed identity. The package identifier, com.ballbounce.Hizbartech, links the listing to an earlier game called Ball Bounce. Reports put that game on the store around August (one archive suggests July), with the switch to Chrome branding around the end of September. The exact dates are still unclear.
  • What it actually did. Users who installed it describe a chat-style app with AI avatars and canned replies, not a web browser.
  • Current status. Later reports say the listing appears to have been removed. Its store link returned "not found" on 14 October, but that doesn't confirm it is gone in every region.

What the evidence does not show

So far nobody has published a code analysis, file hashes or network indicators for this app. There is no public evidence of password theft, remote control, banking overlays, encrypted payloads or exploitation of an Android flaw. Earlier campaigns that used fake Chrome download pages to push spyware, or Play-store "loader" apps that pulled in banking trojans, are separate cases. Their indicators should not be applied to this listing.

The 100K+ figure is also weaker than it looks. Downloads build up under a package name across renames, so the badge does not prove that 100,000 people installed the app while it was posing as Chrome.

Why it matters

Even without a confirmed payload, this shows that a rebranded app can get past store review, take a trusted brand's identity and (reportedly) buy ad placement above the genuine product. The same pattern works just as well for adware, data harvesting or a later malicious update. Users treat a familiar icon, a "sponsored" slot and a big download count as signs of trust. Here, all three were misleading.

What to do

For individuals

  1. On Google Play, open Chrome's page and check that the developer is Google LLC. The real package is com.android.chrome.
  2. Treat sponsored results for well-known apps with suspicion. Scroll to the organic result and check the publisher.
  3. If you installed the Hizbartech "Chrome", uninstall it and run a Google Play Protect scan.

For security and IT teams

  1. In MDM/EMM inventories, search for the package com.ballbounce.Hizbartech, not for the display name "Chrome". Package IDs are far more reliable than app names.
  2. Where possible, allowlist core apps such as browsers by package ID and signing certificate on managed Android devices.
  3. If you find the app, remove it and review the permissions it was granted. Record it as an impersonation or policy finding, not as a confirmed compromise, unless you have separate evidence of data access.
  4. Use this case in awareness training as a concrete example that "sponsored + familiar icon + high downloads" does not mean the app is legitimate.

Sources: originally reported by Cyber Security News, drawing on reporting by PiunikaWeb, Android Authority and SammyGuru, and a user report on Reddit's r/browsers community.

SHARE