Security brief

Chrome Gemini panel flaw could amplify a malicious extension’s access

REVIEW

CVE-2026-0628 concerned a browser privilege boundary; Unit 42 says Google fixed it before the research was published.

Published 29 Oct 2026 · Material update 2 Mar 2026 — last time the underlying evidence changed · Evidence: high

What happened

Unit 42 disclosed a Chrome vulnerability involving the Gemini Live panel. A malicious extension with limited permissions could hijack the privileged panel and reach capabilities beyond its intended access.

The researchers described potential access to camera and microphone, screenshots and local files. The attack required a malicious extension; it was not evidence that simply using Gemini exposed every browser session.

Unit 42 says Google released a fix in early January 2026, before the March disclosure. Keep Chrome updated and review installed extensions. Familiar branding and modest-looking permissions do not remove the need to verify an extension’s publisher and behavior.

Read the original source.

Next step

Update Chrome and remove extensions that are untrusted or unnecessary.

What remains unknown

Open question
The sources reviewed do not establish whether your deployment was exploited.

Source references

Technical details

CVE
CVE-2026-0628