Taming Agentic Browsers: Vulnerability in Chrome Allowed Extensions to Hijack New Gemini Panel
Summary: Unit 42 found a High severity vulnerability, CVE-2026-0628, in Chrome's Gemini feature that let extensions with basic permissions use the declarativeNetRequests API to inject JavaScript into the Gemini panel and gain its privileged access to local files, screenshots, camera and microphone. Unit 42 disclosed it to Google on Oct. 23, 2025, and Google issued a fix in early January 2026.
Key Takeaway: The hijacked Gemini panel is a trusted part of the browser itself, so injected phishing content there carries the browser's credibility, and the attack required no user interaction beyond clicking the Gemini button. A malicious extension reaching a worker's camera, microphone and local files is a direct exposure for the organization, and malicious or hijacked extensions have repeatedly reached large numbers of victims before removal.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Identity & Access Management
- Mentions
- CVE-2026-0628
- Related