High

Google has issued an urgent security update for its Chrome browser to address a high-severity vulnerability in the WebView tag component, tracked as CVE-2026-0628. This flaw stems from insufficient policy enforcement in WebView, a core Chrome feature that allows applications to display web content within their interfaces without launching a full browser. If exploited, this vulnerability could allow attackers to bypass critical security restrictions, potentially leading to unauthorized access, data leakage, or execution of malicious code in affected apps.

The update, delivered through Chrome’s Stable channel, includes version 143.0.7499.192/.193 for Windows and Mac, and 143.0.7499.192 for Linux. Google is gradually rolling out the patch over the coming days and weeks to ensure smooth deployment. In line with responsible disclosure practices, detailed information about the vulnerability has been temporarily restricted to prevent exploitation before the majority of users receive the update.

The WebView component plays a critical role in many applications, making this vulnerability particularly serious. Google’s high-severity rating indicates that attackers could exploit the flaw to bypass security controls within apps, potentially compromising sensitive user data. To identify such vulnerabilities during development, Google uses multiple detection methodologies, including AddressSanitizer, MemorySanitizer, UndefinedBehaviorSanitizer, Control Flow Integrity, libFuzzer, and AFL, reflecting its proactive approach to security.

Google strongly urges users to update Chrome immediately by navigating to Settings > Help > About Google Chrome, where the browser will automatically check for and install available updates. Enterprise organizations should prioritize deploying this security patch across their infrastructure to mitigate potential risks. Additionally, Google continues to encourage collaborative security through its bug bounty program, acknowledging the contributions of external researchers in identifying and addressing vulnerabilities to protect users globally.