CVE-2026-0628 is a vulnerability in Google Chrome versions before 143.0.7499.192 caused by insufficient policy enforcement in the WebView tag. This flaw enables an attacker to deceive a user into installing a malicious Chrome extension that can inject arbitrary scripts or HTML into privileged browser pages. The attack vector requires user interaction to install the extension but does not require any privileges or authentication. The vulnerability impacts confidentiality, integrity, and availability of the affected system. No known exploits have been reported in the wild. The CVSS v3.1 base score is 8.8, reflecting a high severity with network attack vector, low attack complexity, no privileges required, user interaction needed, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows an attacker to inject malicious code into privileged Chrome pages via a malicious extension installed through social engineering. This can lead to compromise of confidentiality, integrity, and availability of user data and browser functionality. However, exploitation requires user interaction to install the extension, and no elevated privileges or authentication are needed. There are no known active exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch links or official fix information is provided, users should monitor Google Chrome updates and apply the latest version once a fix is released. Until then, users should exercise caution when installing Chrome extensions, especially those from untrusted sources, to mitigate risk.