CVE-2026-0628: Google Chrome WebView XSS Vulnerability

CVE-2026-0628 Overview

CVE-2026-0628 is a high-severity vulnerability affecting Google Chrome's WebView tag implementation. The vulnerability stems from insufficient policy enforcement that allows attackers who convince users to install a malicious browser extension to inject scripts or HTML content into privileged pages. This security flaw was categorized by the Chromium security team as high severity, indicating significant potential for exploitation and impact.

Critical Impact

A malicious Chrome extension can bypass security policies to inject arbitrary scripts or HTML into privileged pages, potentially leading to full compromise of the browser's security context and unauthorized access to sensitive user data.

Affected Products

• Google Chrome versions prior to 143.0.7499.192
• Chromium-based browsers utilizing the affected WebView tag implementation
• All platforms running vulnerable Chrome versions (Windows, macOS, Linux)

Discovery Timeline

• 2026-01-07 - CVE-2026-0628 published to NVD
• 2026-01-08 - Last updated in NVD database

Technical Details for CVE-2026-0628

Vulnerability Analysis

This vulnerability is classified under CWE-862 (Missing Authorization), which represents a fundamental security flaw where the application fails to perform proper authorization checks before granting access to protected resources or functionality. In the context of Chrome's WebView tag, the insufficient policy enforcement allows malicious extensions to bypass the normal security boundaries that isolate extension content from privileged browser pages.

The WebView tag in Chrome extensions is designed to display web content within extension pages while maintaining security isolation. However, due to the policy enforcement gap, a crafted extension can circumvent these protections and inject malicious content directly into privileged contexts. This could allow attackers to access sensitive browser APIs, steal user credentials, manipulate browser settings, or perform actions on behalf of the user.

Root Cause

The root cause lies in the WebView tag's failure to properly enforce Content Security Policy (CSP) restrictions and privilege separation between extension contexts and privileged Chrome pages. The authorization checks that should prevent untrusted extension code from accessing or modifying privileged page content were insufficient, creating an opportunity for script and HTML injection attacks.

Attack Vector

The attack requires social engineering to convince a victim to install a malicious Chrome extension. Once installed, the extension can leverage the WebView tag vulnerability to:

1. Inject arbitrary JavaScript into privileged Chrome pages (such as chrome:// URLs or extension management pages)
2. Insert HTML content that could be used for phishing or credential theft
3. Access sensitive browser APIs that should be restricted from extension access
4. Potentially escalate privileges beyond the normal extension permission model

The exploitation mechanism relies on crafting a Chrome extension that abuses the WebView tag's insufficient policy checks. When the malicious extension loads a WebView, it can manipulate the content or inject scripts that execute in a more privileged context than intended. For detailed technical information, refer to the Chromium Issue Tracker #463155954.

Detection Methods for CVE-2026-0628

Indicators of Compromise

• Presence of unfamiliar or recently installed Chrome extensions with broad permissions
• Browser extension network traffic to suspicious or unknown domains
• Unexpected modifications to Chrome settings or preferences
• JavaScript execution in chrome:// pages originating from extension contexts

Detection Strategies

• Monitor Chrome extension installation events and review extension permissions
• Implement browser extension allowlisting policies to prevent unauthorized installations
• Deploy endpoint detection rules to identify suspicious extension behavior patterns
• Review browser process activity for anomalous cross-context script execution

Monitoring Recommendations

• Enable Chrome enterprise logging to capture extension-related events
• Configure endpoint protection to alert on new extension installations
• Implement network monitoring for extension callback URLs and suspicious traffic
• Conduct regular audits of installed browser extensions across the organization

How to Mitigate CVE-2026-0628

Immediate Actions Required

• Update Google Chrome to version 143.0.7499.192 or later immediately
• Review and remove any suspicious or unnecessary browser extensions
• Implement Chrome enterprise policies to restrict extension installations to approved sources only
• Educate users about the risks of installing extensions from untrusted sources

Patch Information

Google has addressed this vulnerability in Chrome version 143.0.7499.192. The security update includes enhanced policy enforcement in the WebView tag implementation to prevent unauthorized script and HTML injection into privileged pages. Organizations should deploy this update through their standard browser update mechanisms. For official patch details, refer to the Google Chrome Stable Update announcement.

Workarounds

• Restrict Chrome extension installations using the ExtensionInstallBlocklist and ExtensionInstallAllowlist policies
• Disable extensions from unknown sources by configuring ExtensionInstallSources policy
• Use Chrome's built-in Safe Browsing enhanced protection mode
• Consider using browser isolation technologies for high-risk browsing activities

# Chrome Enterprise Policy Configuration (Windows Registry)
# Block all extensions except those explicitly allowed
reg add "HKLM\SOFTWARE\Policies\Google\Chrome" /v ExtensionInstallBlocklist /t REG_SZ /d "*" /f

# Allow only specific trusted extensions (replace with your approved extension IDs)
reg add "HKLM\SOFTWARE\Policies\Google\Chrome\ExtensionInstallAllowlist" /v 1 /t REG_SZ /d "approved-extension-id-1" /f
reg add "HKLM\SOFTWARE\Policies\Google\Chrome\ExtensionInstallAllowlist" /v 2 /t REG_SZ /d "approved-extension-id-2" /f