VulnSocial
← Back to blog

CVE-2026-0628 – High Severity Policy Enforcement Flaw in Google Chrome Gemini Panel

Key takeaways

  • Severity: High (CVSS 8.8)
  • Impact: Privilege escalation via malicious extension; can inject code into Gemini side panel, access camera, microphone, screenshots, and local files.
  • Affected: Google Chrome (all platforms) < 143.0.7499.192 and Chromium builds (e.g., Fedora 42/43).
  • Action: Update Chrome to 143.0.7499.192+; enforce strict extension policies; monitor for suspicious extension activity.

Overview

The newly disclosed CVE-2026-0628 is a high-severity (CVSS 8.8) vulnerability in the WebView policy enforcement used by the Gemini AI side-panel in Google Chrome (and Chromium). A malicious extension that convinces a user to install it can bypass the intended isolation and inject arbitrary scripts or HTML into the privileged Gemini panel, effectively escalating its privileges to the browser’s top-level context.

Technical Details

Chrome’s Gemini panel is rendered inside a WebView component. The component is supposed to enforce a strict content security policy that isolates the panel from extensions. In versions prior to 143.0.7499.192, the policy check is incomplete (CWE-862: Missing Authorization). An attacker who distributes a crafted extension can:

  • Register a content script that matches the Gemini panel’s URL.
  • Use the extension’s elevated privileges (no user interaction required after install) to inject JavaScript or HTML into the panel.
  • Once code runs in the Gemini context, it can invoke the panel’s internal APIs, capture screenshots, read the webcam/microphone streams, and read/write local files via the browser’s file system access APIs.

The vulnerability is triggered remotely; the attacker only needs to persuade the victim to install the malicious extension. No additional user interaction is required after installation (UI-required flag is set to R in the CVSS vector).

Severity & Impact

The CVSS-3.1 vector for CVE-2026-0628 is:

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

This translates to full confidentiality, integrity, and availability impact. An exploited extension can:

  • Read any file the user can access, including sensitive documents.
  • Control the webcam and microphone, enabling covert surveillance.
  • Capture screenshots of any active window.
  • Execute arbitrary code in the browser’s privileged context, potentially leading to further system compromise.

While no active exploitation has been observed in the wild, the attack surface is attractive to nation-state and financially motivated actors.

Affected Products

The flaw affects Google Chrome and Chromium-based browsers that ship the vulnerable WebView implementation. Specifically:

  • Chrome versions < 143.0.7499.192 on Windows, macOS, Linux, and Chrome OS.
  • Chromium packages derived from the same source (e.g., Fedora 42 and Fedora 43 Chromium builds referenced in their security advisories).

For a complete list of affected versions and platforms, see the official CVE page: https://vulnsocial.com/cve/CVE-2026-0628.

Actionable Insights – What to Do Now

  • Patch immediately: Upgrade Chrome to 143.0.7499.192 or later. Enterprise deployments should push the update via management tools.
  • Restrict extensions: Use Chrome Enterprise policies such as ExtensionInstallWhitelist or ExtensionInstallBlocklist to allow only vetted extensions.
  • Disable Gemini panel (if not needed): The panel can be turned off via chrome://flags#enable-gemini or by removing the gemini permission from the manifest of installed extensions.
  • Monitor extension activity: Enable Chrome’s --enable-logging flag and watch for Extension install events and WebView policy violations in the log files.
  • Audit file system access: Look for unexpected file reads/writes from Chrome processes using OS-level auditing (e.g., Windows Event Log, Linux auditd).
  • Network detection: Flag outbound connections to gemini.google.com from browsers that are not actively using the AI assistant.
  • Educate users: Reinforce the principle of “install extensions only from trusted sources.”

Remediation & Mitigation

  1. Update Chrome to version 143.0.7499.192 or newer. Verify the version via chrome://settings/help.
  2. For Linux distributions, apply the latest Chromium packages (e.g., dnf update chromium on Fedora 42/43).
  3. Enforce extension whitelisting using the Chrome Enterprise policy ExtensionInstallWhitelist.
  4. Disable the Gemini AI side-panel if not required: set chrome://flags#enable-gemini to Disabled or remove the gemini permission.
  5. Enable logging (--enable-logging --v=1) and regularly review the logs for any WebView policy bypass attempts.
  6. Conduct a post-update scan for any lingering malicious extensions using the Chrome extensions page (chrome://extensions).
  7. Integrate threat-intel feeds (e.g., VulnSocial) into your SIEM to receive real-time alerts for any new indicators related to CVE-2026-0628.

Bottom Line

CVE-2026-0628 is a high-severity (CVSS 8.8) WebView policy enforcement flaw that lets a malicious Chrome extension hijack the Gemini AI panel and gain unrestricted access to camera, microphone, screenshots, and local files. The quickest defence is to patch all Chrome/Chromium installations and tighten extension controls.

References

#CVE #CVE20260628 #High #Chrome #Google #WebView #Extension #Security #Patch