Chrome Gemini vulnerability allowed malicious extensions to hijack AI panel
A high-severity vulnerability in Google Chrome's Gemini AI feature allowed malicious extensions to hijack the AI panel and gain unauthorized access to system resources including webcams, microphones, and local files. Google released a patch in January 2026 after the flaw was disclosed by Palo Alto Networks researchers in October 2025.
What happened
A high-severity vulnerability in Google Chrome's Gemini AI feature was discovered by Palo Alto Networks' Unit 42. Tracked as CVE-2026-0628, the flaw was described as insufficient policy enforcement in the WebView tag that allowed an attacker who convinced a user to install a malicious extension to inject scripts or HTML into a privileged page via a crafted Chrome Extension.
An extension with access to basic permissions, via the declarativeNetRequests API, could grant permissions that an attacker could exploit to inject JavaScript code into the Gemini panel browser component. This vulnerability could be used as part of a broader attack chain targeting Chrome users.
Reported impact
If exploited, the vulnerability could allow a malicious extension to hijack the Gemini panel and take action without permission. The AI assistant could then grant cybercriminal access to webcams and microphones, take screenshots, and access local files and directories.
Since the Gemini app relies on performing actions for legitimate purposes, hijacking the Gemini panel allows privileged access to system resources that an extension would not normally have. The panel could also be hijacked for phishing purposes.
Index analysis
The integration of AI features into web browsers creates a new security challenge. AI browsers must be granted privileged access to the browsing environment so they can see what the user sees and get information from the website, but this expanded capability and privileged access introduce a new and widened attack surface.
Governance controls
Following Palo Alto Networks' private disclosure to Google in October 2025, Google's Chrome security team triaged, replicated, and patched the bug. The fix was included in Chrome version 143.0.7499.192 and released in early January 2026.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.