fevar54/cve-2026-0628-pocPoC de CVE-2026-0628: inyeccion de scripts en paginas privilegiadas via webview en Chrome (CWE-862).
Proof of Concept (PoC) for CVE-2026-0628, demonstrating script injection into privileged pages through the use of the <webview> tag in Google Chrome. This vulnerability, classified as CWE-862 (Missing Authorization), allows a malicious extension to bypass security policies in versions prior to 143.0.7499.192.
Proof of Concept (PoC) for CVE-2026-0628, demonstrating script injection into privileged pages through the use of the <webview> tag in Google Chrome. This vulnerability, classified as CWE-862 (Missing Authorization), allows a malicious extension to bypass security policies in versions prior to 143.0.7499.192.
CVE-2026-0628-PoC/ ├── manifest.json # Extension manifest ├── background.js # Background script ├── payload.html # HTML page with the payload ├── exploit/ # Exploitation files │ ├── inject.js # Script injected into the WebView │ └── privileged.html # Example page with privileges └── README.md
Load the unpacked extension in Google Chrome:
Navigate to chrome://extensions/. Enable "Developer mode". Click "Load unpacked" and select the repository folder. Open a Chrome page (e.g. chrome://settings) to observe the execution of the injected script.
🛡️ Mitigation Update Google Chrome to version 143.0.7499.192 or higher to fix this vulnerability.
📄 References Chrome Stable Channel Update (Jan 6, 2026) NVD - CVE-2026-0628 Issue Tracker 463155954 ⚠️ Disclaimer This code is for educational and security research purposes only. It must not be used for malicious purposes or without authorization. The author is not responsible for any misuse of this information.
📜 License This project is for educational purposes only.
