PT-2026-1549 · Google+2 · Google Chrome+2

Gal Weizman · Published 2026-01-06 · Updated 2026-03-28 · CVE-2026-0628

Positive Technologies · (AI Summary)

CVSS v2.0

10

High

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 143.0.7499.192 Chromium versions prior to 143.0.7499.192 Android System WebView versions prior to 143.0.7499.192 Microsoft Edge (Chromium-based) versions prior to 143.0.7499.192 chromedriver versions prior to 143.0.7499.192-1.1 Debian chromium versions 143.0.7499.192-1deb12u1 and 143.0.7499.192-1deb13u1

Description A high-severity vulnerability exists in Google Chrome and Chromium due to insufficient policy enforcement within the WebView tag. This flaw allows a malicious browser extension, even with basic permissions, to inject scripts or HTML into privileged pages via a crafted Chrome Extension. Exploitation can lead to privilege escalation, enabling access to sensitive resources such as the camera, microphone, screenshots, and local files. The vulnerability, tracked as CVE-2026-0628, impacts Chrome’s Gemini AI panel and WebView-based applications. The issue arises from the way Chrome handles declarativeNetRequest for the Gemini WebView, creating a new attack surface. The vulnerability does not require user interaction and can be exploited by simply installing a malicious extension.

Recommendations Update Google Chrome to version 143.0.7499.192 or later. Update Chromium to version 143.0.7499.192 or later. Update Android System WebView to version 143.0.7499.192 or later. Update Microsoft Edge (Chromium-based) to version 143.0.7499.192 or later. Update chromedriver to version 143.0.7499.192-1.1 or later. Restrict extension installation policies to prevent untrusted extensions. Review installed extensions and remove any that are unrecognized or recently requested new permissions.

Exploit

Fix

LPE

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

BDU:2026-00887

CVE-2026-0628

DSA-6097-1

OPENSUSE-SU-2026:10016-1

OPENSUSE-SU-2026:20020-1

Affected Products

Debian

Google Chrome

Red Os

References · 105

• 🔥 https://github.com/sastraadiwiguna-purpleeliteteaming/Dissecting-CVE-2026-0628-Chromium-Extension-Privilege-Escalation · Exploit
• https://osv.dev/vulnerability/DSA-6097-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10016-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-00887 · Security Note
• https://osv.dev/vulnerability/CVE-2026-0628 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:20020-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0628 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-0628 · Security Note
• https://safe-surf.ru/specialists/bulletins-nkcki/728261 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-0628 · Vendor Advisory
• http://repo.red-soft.ru/redos/8.0/x86_64/updates · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-0628 · Vendor Advisory
• https://safe-surf.ru/specialists/bulletins-nkcki/728048 · Security Note
• https://twitter.com/Awesome_AI_News/status/2029098111101223258 · Twitter Post
• https://twitter.com/technoholic_me/status/2030123309606543780 · Twitter Post