CVE-2026-0628Not scored
Google Chrome vulnerability
Google · Chrome
Not in CISA KEVVendor fix available
20.9%probability of exploitation in the next 30 days
97th percentile
050100
Higher than 97% of scored CVEs
Not scored yet. NVD has not published a CVSS score.
DescriptionNVD
Insufficient policy enforcement in WebView tag in Google Chrome prior to 143.0.7499.192 allowed an attacker who convinced a user to install a malicious extension to inject scripts or HTML into a privileged page via a crafted Chrome Extension. (Chromium security severity: High)
Coverage7 articles · 6 outlets
First in our coverage: Unit 42, 2 Mar.
Quiet for 7 weekslast report 16 Sep7 articles6 outlets
- Mon 2 Mar, 11:08 UTC. Unit 42, first report. Chrome Gemini CVE-2026-0628 lets extensions hijack the panel.
- Mon 2 Mar, 13:11 UTC. Dark Reading, its first report on the story. Google patches CVE-2026-0628 in Chrome Gemini AI panel.
- Mon 2 Mar, 15:44 UTC. SecurityWeek, its first report on the story. Chrome CVE-2026-0628 lets extensions hijack Gemini Live AI.
- Mon 2 Mar, 17:46 UTC. The Hacker News, its first report on the story. Chrome CVE-2026-0628 enables WebView abuse to access camera, mic.
- Tue 3 Mar, 10:02 UTC. Security Affairs, its first report on the story. Chrome patch stops extension hijack of Gemini Live, CVE-2026-0628.
- Tue 3 Mar, 12:34 UTC. Malwarebytes, its first report on the story. Chrome Gemini side panel CVE-2026-0628 exposes extension abuse.
- Wed 16 Sep, 17:13 UTC. Dark Reading. Browser Extensions Hijacked AI Assistants in Five Major Browsers.
- Chrome Gemini CVE-2026-0628 lets extensions hijack the panelUnit 42 · first in our coverage
New articles also arrive in the RSS feed.