Update Chrome now to avoid a Web app disaster, says Google

Just a heads up, if you buy something through our links, we may get a small share of the sale. It’s one of the ways we keep the lights on here. Click here for more.

Google just pushed an urgent Chrome security update that anyone with a browser should install, especially if you live inside web apps all day.

The bug, tracked as CVE-2026-0628, lives in Chrome’s WebView component, which is what a ton of Android apps and in-app browsers use to render web content without kicking you out to a full browser.

Because of that, this isn’t just a “desktop Chrome” problem—Google’s talking about risk to roughly 3 billion users across Chrome and Android.

The flaw boils down to weak policy enforcement in the WebView tag, which can let attackers bypass security controls that are supposed to stop sketchy scripts and data access.

With the right malicious extension or payload, an attacker could inject scripts or HTML into privileged pages and potentially get at data that should be locked down.

U.S. CISA describes it as a security bypass in Chrome before version 143.0.7499.192, which is now the baseline you want to be on or above.

Google has started rolling out Chrome 143.0.7499.192/.193 for Windows and macOS, and 143.0.7499.192 for Linux via the Stable channel, with Chrome 143 landing on Google Play for Android.

If you do not want to wait, head to Settings > About Chrome on desktop to force an update check, then restart the browser to actually apply the patch.

On Android, jump into Google Play, check for app updates, and make sure Chrome is on version 143 or later.

As usual, Google is holding back the deep technical details until enough of the install base is patched, to avoid handing threat actors a ready-made exploit.

If you manage multiple machines, fleets, or even just family tech support, this is one to prioritize across every device where Chrome or embedded WebView apps are in play.

Kevin Raposo

Kevin is KnowTechie's founder and executive editor. With over 15 years of blogging experience in the tech industry, Kevin has transformed what was once a passion project into a full-blown tech news publication. Shoot him an email at kevin@knowtechie.com.