Chrome Gemini Spy Vulnerability Exposed

🔑 Enhanced Key Takeaways

• •The vulnerability is identified as CVE-2026-0628, specifically affecting Chrome's Gemini Live panel, allowing malicious extensions using declarativeNetRequests API to inject JavaScript and escalate privileges.[1]
• •Exploitation enabled unauthorized access to camera, microphone, local files, screenshots of HTTPS websites, and phishing via the hijacked panel, as demonstrated in proof-of-concept attacks.[1][6]
• •Palo Alto Networks Unit 42 responsibly disclosed the flaw to Google, who patched it in early January 2026 before public disclosure.[1]

🛠️ Technical Deep Dive

• •Malicious extensions with basic declarativeNetRequests permissions could intercept and inject JavaScript into the Gemini Live panel, unlike ordinary tabs where such injection grants no special powers.[1]
• •The Gemini panel in Chrome is hooked with elevated capabilities including local file reads, camera/microphone access without consent, HTTPS tab screenshots, and complex task execution.[1]
• •Attack relied on the panel's privileged environment versus standard web app tabs, enabling privilege escalation from basic extension permissions.[1]

🔮 Future ImplicationsAI analysis grounded in cited sources

⏳ Timeline