CVE-2026-0628
HIGHGoogle Chrome < 143.0.7499.192 - Insufficient Policy Enforcement in WebView Tag
Title source: llmExploitation Summary
EIP tracks 4 public exploits for CVE-2026-0628. PoCs published by XiaomingX, sastraadiwiguna-purpleeliteteaming, fevar54.
AI-analyzed exploit summary This repository contains a detailed technical writeup and researcher background for CVE-2026-0628, a Chromium WebView privilege escalation vulnerability. It includes in-depth analysis, mitigation strategies, and detection methods but lacks functional exploit code.
Description
Insufficient policy enforcement in WebView tag in Google Chrome prior to 143.0.7499.192 allowed an attacker who convinced a user to install a malicious extension to inject scripts or HTML into a privileged page via a crafted Chrome Extension. (Chromium security severity: High)
Exploits (4)
This repository contains a detailed technical writeup and researcher background for CVE-2026-0628, a Chromium WebView privilege escalation vulnerability. It includes in-depth analysis, mitigation strategies, and detection methods but lacks functional exploit code.
This repository provides a detailed technical analysis of CVE-2026-0628, a Chromium WebView privilege escalation vulnerability, including root cause analysis, mitigation strategies, and detection techniques. It does not contain exploit code but offers in-depth research and defensive guidance.
This repository provides a detailed technical analysis of CVE-2026-0628, a Chromium WebView privilege escalation vulnerability, including root cause analysis, mitigation strategies, and detection techniques. It does not contain exploit code but offers in-depth research and defensive guidance.
This repository contains a functional proof-of-concept for CVE-2026-0628, demonstrating script injection in privileged Chrome pages via the `<webview>` tag. The exploit leverages a missing authorization vulnerability (CWE-862) in Chrome versions prior to 143.0.7499.192.
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H