CVE-2026-0628

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 143.0.7499.192

Description Insufficient policy enforcement in the WebView tag allows a remote attacker to inject arbitrary scripts or HTML into privileged pages if a user is convinced to install a malicious Chrome extension. This flaw enables privilege escalation, potentially allowing the extension to bypass security boundaries and gain unauthorized access to sensitive capabilities, such as reading local files, taking screenshots, and accessing the camera and microphone. Specifically, the issue affects the integration of the Gemini AI side panel, where a crafted extension can intercept traffic and inherit the panel's high-level privileges to execute arbitrary code, cause a denial of service, or disclose information.

Recommendations Update Google Chrome to version 143.0.7499.192 or later. Restrict extension installation policies via enterprise policies or user education to prevent the addition of untrusted extensions.