LIVE FEED
Check Point gateways hacked via PHP2Shell to deploy VMware ESXi wiperHardening a Personal Linux Server in an AfternoonMicrosoft 365 outage disrupts Outlook, Teams, and Copilot worldwideCheck Point patches zero-day root escalation flaw exploited against customersHackers Compromise 4,800 GitHub Accounts to Steal Cloud CredentialsHow to Put a Self-Hosted Service Behind SSO and Intrusion Blocking in an AfternoonBaker Tilly notifies clients of data breach at third-party provider
HIGH CWE-862

CVE-2026-0628

Google Chrome vulnerability

Google·Chrome

8.8/ 10
CVSS 3.1
High severity
21%
EPSS exploit odds
Chance of exploitation in the next 30 days
Higher than 98% of all CVEs
Not listed
CISA KEV catalog
No confirmed in-the-wild exploitation on CISA's list.
Timeline
Published
Jan 6, 2026
Updated
Feb 26, 2026
First covered
Sep 19, 2026
Latest story
2 months ago

Summary

Insufficient policy enforcement in WebView tag in Google Chrome prior to 143.0.7499.192 allowed an attacker who convinced a user to install a malicious extension to inject scripts or HTML into a privileged page via a crafted Chrome Extension. (Chromium security severity: High)

CWE-862Missing Authorization

Attack profile

Attack vectorNetwork
ComplexityLow
PrivilegesNone
User interactionRequired
ScopeUnchanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected products

  • Google Chrome143.0.7499.192 to before 143.0.7499.192

References

CVE.org recordcve.org NVD entrynvd.nist.gov Advisorychromereleases.googleblog.com Advisoryissues.chromium.org
Daily at 7:00 AM Eastern

The 0700 Brief

Every new security and AI story, summarised in one email. Confirm by email, unsubscribe in one click.

43 readers have subscribed