CVE-2026-0628
High · 8.8CVSS
8.8
EPSS
20.9%
Published
Jan 7, 2026
CISA due date
—
The record
Insufficient policy enforcement in WebView tag in Google Chrome prior to 143.0.7499.192 allowed an attacker who convinced a user to install a malicious extension to inject scripts or HTML into a privileged page via a crafted Chrome Extension. (Chromium security severity: High)
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Chainguard | chromium | 0 | 144.0.7559.109-r0 |
| Wolfi | chromium | 0 | 144.0.7559.109-r0 |
| openSUSE:Leap 16.0 | chromium | 0 | 143.0.7499.192-bp160.1.1 |
| openSUSE:Tumbleweed | chromium | 0 | 143.0.7499.192-1.1 |
Related vulnerabilities
- CVE-2026-4453 Integer overflow in Dawn in Google Chrome on Mac prior to 146.0.7680.153 allowed a remote… Also affects chromium
- CVE-2026-3942 Incorrect security UI in PictureInPicture in Google Chrome prior to 146.0.7680.71 allowed… Also affects chromium
- CVE-2026-3934 Insufficient policy enforcement in ChromeDriver in Google Chrome prior to 146.0.7680.71… Also affects chromium
- CVE-2026-3936 Use after free in WebView in Google Chrome on Android prior to 146.0.7680.71 allowed a… Also affects chromium
- CVE-2026-3938 Insufficient policy enforcement in Clipboard in Google Chrome prior to 146.0.7680.71… Also affects chromium
- CVE-2026-3940 Insufficient policy enforcement in DevTools in Google Chrome prior to 146.0.7680.71… Also affects chromium
- CVE-2026-3941 Insufficient policy enforcement in DevTools in Google Chrome prior to 146.0.7680.71… Also affects chromium
- CVE-2026-3935 Incorrect security UI in WebAppInstalls in Google Chrome prior to 146.0.7680.71 allowed a… Also affects chromium