CVE detail
CVE-2026-0628
Insufficient policy enforcement in WebView tag in Google Chrome prior to 143.0.7499.192 allowed an attacker who convinced a user to install a malicious extension to inject scripts or HTML into a privileged page via a crafted Chrome Extension. (Chromium security severity: High)
Buzz score
Why this CVE is surfacing
This all-time snapshot uses the same composite formula as Trending across a 30-year evidence window, rather than a current rolling window.
Buzz score components · mention 20.8 · diversity 20.0 · KEV 0.0 · OTX 0.0 · PoC 0.0
Why it matters now
Mention timeline
- Total mentions
- 0
- within the 30d window
- Peak daily
- 0
- highest bucket
Evidence
Source links by recency
7 source links · newest first
- 9th March – Threat Intelligence ReportCheck Point Research
For the latest discoveries in cyber research for the week of 9th March, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES AkzoNobel, a Netherlands-based global paint manufacturer, has confirmed a cyberattack affecting one of its United States sites. The company said the intrusion was contained, while the Anubis ransomware group claimed it stole […]
vendorresearch.checkpoint.comMar 9, 2026, 4:36 PM - March 2026 Patch Tuesday forecast: Is AI security an oxymoron?Help Net Security
Developers and analysts are using more AI tools to produce code and to test both the performance and security of the finished products. They are also embedding AI functionality in their products directly. But just how secure are these AI tools and routines themselves? Recent reports show they suffer from vulnerabilities just like any other code. For example, Google recently provided an update for CVE-2026-0628, associated with Gemini AI implemented in the Chrome browser. This … More →
newswww.helpnetsecurity.comMar 6, 2026, 8:22 AM - Chrome security flaw enabled spying via Gemini Live assistantSecurity Affairs
A Google Chrome vulnerability lets malicious extensions hijack Gemini Live to spy on users and steal sensitive files. Researchers at Palo Alto Networks found a Chrome vulnerability, tracked as CVE-2026-0628, that could let malicious extensions take control of the Gemini Live AI assistant. By abusing the flaw, attackers could spy on users and exfiltrate sensitive […]
newssecurityaffairs.comMar 3, 2026, 8:48 AM Malicious extensions could hijack the Gemini Live in Chrome feature to spy on users and steal their files.
newswww.securityweek.comMar 2, 2026, 3:26 PM- Taming Agentic Browsers: Vulnerability in Chrome Allowed Extensions to Hijack New Gemini PanelUnit42
A high-severity CVE-2026-0628 in Chrome's Gemini allowed local file access and privacy invasion. Google quickly patched the flaw.
vendorunit42.paloaltonetworks.comMar 2, 2026, 11:00 AM - https://issues.chromium.org/issues/463155954issues.chromium.org
No excerpt available.
Exploitissues.chromium.orgJan 7, 2026, 12:17 PM - https://chromereleases.googleblog.com/2026/01/stable-channel-update-for-desktop.htmlchromereleases.googleblog.com
No excerpt available.
Vendor Advisorychromereleases.googleblog.comJan 7, 2026, 12:17 PM
Exploit code
Public exploit repository references
Public PoC repositories are third-party, potentially unsafe artifacts. Treat their code as untrusted and use it only on authorized systems in an isolated, least-privilege environment. cvebuzz does not execute the code or verify that an exploit works.
0 repository references · best confidence N/A · max 0 stars
Related records
Similar CVEs
6 related CVEs with shared weakness or product evidence
- CVE-2026-14156CVSS 6.5 · Medium
Insufficient policy enforcement in StorageAccessAPI in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to bypass same origi…
- CVE-2026-8547CVSS 7.5 · High
Insufficient policy enforcement in Passwords in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to perform priv…
- CVE-2021-37976CVSS 6.5 · Medium
Inappropriate implementation in Memory in Google Chrome prior to 94.0.4606.71 allowed a remote attacker to obtain potentially sensitive information from process memory via a craft…
- CVE-2020-16029CVSS 8.8 · High
Inappropriate implementation in PDFium in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to bypass navigation restrictions via a crafted PDF file.
- CVE-2020-16027CVSS 6.5 · Medium
Insufficient policy enforcement in developer tools in Google Chrome prior to 87.0.4280.66 allowed an attacker who convinced a user to install a malicious extension to obtain poten…
- CVE-2020-6393CVSS 6.5 · Medium
Insufficient policy enforcement in Blink in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to leak cross-origin data via a crafted HTML page.