CVE-2026-0628 is a vulnerability identified in Google Chrome versions prior to 143.0.7499.192, specifically related to insufficient policy enforcement in the WebView tag. The WebView tag is used to embed web content within Chrome extensions or applications. Due to inadequate enforcement of security policies, a malicious Chrome extension—if installed by a user—can exploit this flaw to inject arbitrary scripts or HTML content into privileged pages within the browser. This injection capability can lead to unauthorized actions such as privilege escalation, data theft, or manipulation of browser internals. The attack vector requires social engineering to convince users to install a crafted malicious extension, which then leverages the WebView policy weakness. Although no active exploits have been reported, the vulnerability is classified as high severity by Chromium security due to the potential impact on user security and browser integrity. The lack of a CVSS score suggests this is a newly disclosed issue, but the technical details indicate a significant risk. The vulnerability affects all Chrome installations running versions before 143.0.7499.192, which is a widely deployed browser globally, including across Europe. The issue underscores the importance of strict extension vetting and timely patching to prevent exploitation.

For European organizations, this vulnerability could lead to unauthorized access to sensitive information, manipulation of browser sessions, or execution of malicious code within the context of privileged browser pages. This can compromise confidentiality and integrity of data accessed via Chrome, potentially affecting corporate web applications, internal portals, or cloud services accessed through the browser. Given Chrome's dominant market share in Europe, many enterprises, government agencies, and critical infrastructure operators could be exposed. The attack requires user interaction (installing a malicious extension), which means phishing or social engineering campaigns could be effective vectors. Successful exploitation could facilitate further lateral movement within networks or data exfiltration. The absence of known exploits currently limits immediate risk, but the vulnerability remains a significant threat if weaponized. Organizations relying heavily on Chrome for secure workflows or handling sensitive data are particularly vulnerable.

The primary mitigation is to update Google Chrome to version 143.0.7499.192 or later, where the vulnerability is fixed. Organizations should enforce strict policies on extension installation, limiting users to only approved extensions from trusted sources. Employ enterprise management tools to control Chrome extension permissions and monitor extension activity. User awareness training should emphasize the risks of installing untrusted extensions and recognizing phishing attempts. Implement browser security features such as site isolation and content security policies to reduce the impact of potential script injections. Regularly audit installed extensions and remove any that are unnecessary or suspicious. For high-security environments, consider using browser sandboxing or alternative browsers with different security postures until patches are applied. Monitoring network traffic for unusual activity related to browser extensions can also help detect exploitation attempts early.