PT-2026-1549 · Google+2 · Google Chrome+2

Gal Weizman · Published 2026-01-06 · Updated 2026-05-05 · CVE-2026-0628

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 143.0.7499.192

Description Insufficient policy enforcement in the WebView tag allows a remote attacker to inject scripts or HTML into privileged pages via a crafted Chrome extension. This issue can be exploited if a user is convinced to install a malicious extension. Specifically, the flaw allows extensions to intercept traffic and inject JavaScript into the Gemini AI side panel, which operates in a highly privileged context. This leads to privilege escalation, enabling the attacker to silently activate the webcam and microphone, capture screenshots, read local files, and inject fake messages into the Gemini interface.

Recommendations Update Google Chrome to version 143.0.7499.192 or later. Restrict extension installation policies via enterprise policies or user education to prevent untrusted extensions from being added.

Exploit

Fix

LPE

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

BDU:2026-00887

CVE-2026-0628

DSA-6097-1

OPENSUSE-SU-2026:10016-1

OPENSUSE-SU-2026:20020-1

Affected Products

Debian

Google Chrome

Red Os

References · 113

• 🔥 https://github.com/sastraadiwiguna-purpleeliteteaming/Dissecting-CVE-2026-0628-Chromium-Extension-Privilege-Escalation · Exploit
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2026-0421SE17 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se18-bulletin-2026-0423SE18MD · Vendor Advisory
• http://repo.red-soft.ru/redos/8.0/x86_64/updates · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-00887 · Security Note
• https://safe-surf.ru/specialists/bulletins-nkcki/728261 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-0628 · Security Note
• https://safe-surf.ru/specialists/bulletins-nkcki/728048 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0628 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2026:10016-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-0628 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:20020-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-0628 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-0628 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-6097-1 · Vendor Advisory