CVE-2026-0628

CVE-2026-0628 is a high-severity vulnerability in Google Chrome prior to version 143.0.7499.192, stemming from insufficient policy enforcement within the WebView tag. This flaw allows a malicious Chrome extension, if installed by a user, to inject scripts or HTML into privileged pages. The vulnerability carries a CVSS score of 8.8 (HIGH), indicating a critical risk with high impacts on confidentiality, integrity, and availability, requiring user interaction but no prior authentication. The attack vector is network-based with low complexity, as an attacker needs to convince a user to install a malicious extension. The potential impact is significant, enabling an attacker to gain control over privileged browser functions, as highlighted by reports of extensions potentially hijacking Gemini's camera, microphone, and file access. Currently, there is no evidence of active exploitation (KEV: No), and no public exploit code is available on platforms like Metasploit, Nuclei, or ExploitDB. Despite this, the vulnerability has garnered substantial community attention with over 10 mentions and 8 media articles, indicating a high level of concern and discussion within the cybersecurity community.