CVE-2026-0628

High8.8Published on January 7, 2026

Insufficient policy enforcement in WebView tag in Google Chrome prior to 143.0.7499.192 allowed an attacker who convinced a user to install a malicious extension to inject scripts or HTML into a privileged page via a crafted Chrome Extension. (Chromium security severity: High)

CVSS score8.8 / 10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness type (CWE)CWE-862

Vendorsgoogle

Affected products

Vendors	Product	Versions
google	chrome	< 143.0.7499.192

BragJack Turns Browser Extensions Into Control Channels for AI Agents

BragJack shows how a malicious Chrome extension can hijack Gemini, Comet, Edge, Opera and Claude AI agents to steal files and take actions.

Sep 19, 202623:377 min readRead

This product uses the NVD API but is not endorsed or certified by the NVD.

CVE database

Affected products

Related articles

BragJack Turns Browser Extensions Into Control Channels for AI Agents