New Chrome Vulnerability Let Malicious Extensions Escalate Privileges via Gemini Panel
Summary: Google patched CVE-2026-0628, a CVSS 8.8 insufficient policy enforcement flaw in Chrome's WebView tag, in version 143.0.7499.192/.193 for Windows/Mac and 143.0.7499.192 for Linux in early January 2026. Palo Alto Networks Unit 42 researcher Gal Weizman, who reported the flaw on November 23, 2025, said a malicious extension with basic permissions could seize control of the Gemini Live panel via the chrome://glic URL and gain access to the camera, microphone, screenshots, and local files.
What's compelling: The Gemini panel is hooked into capabilities the browser normally guards, so a single crafted extension installed by a tricked user crossed from by-design extension behavior into arbitrary code running at gemini.google.com/app. Unit 42's point is structural: every AI side panel added to a browser inherits the classic XSS and privilege-escalation risks of the high-privilege context it sits in.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-0628
- Related