Disclosed vulnerability
CVE-2026-0628: malicious Chrome extension injects script into the privileged Gemini Live panel to reach camera, mic, files and screenshots
AIR-2026-0055 AIR record · 2026-03-google-chrome-gemini-glic-privilege-escalation
From the supporting source
Insufficient policy enforcement in WebView tag in Google Chrome prior to 143.0.7499.192 allowed an attacker who convinced a user to install a malicious extension to inject scripts or HTML into a privileged page via a crafted Chrome extension.thehackernews.com
The record
Disclosed
2026-03-02
Vendor
Google
Product
Gemini in Chrome (chrome://glic Gemini Live side panel)
Risk domain
Tool misuse › Supply chain vulnerabilities
Also touches
Privilege escalation, Data exfiltration channels
System type
Generative model
Who acted
AI was the target — a malicious extension injected script into a privileged browser page
Attack surface
Browser agent
Autonomy level
Assistant
Initial vector
Extension script injection into privileged browser page
Impact type
Privilege escalation, Surveillance, Data exfiltration
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI04 – Agentic Supply Chain Vulnerabilities
- MITRE ATLAS
- AML.T0040 – AI Supply Chain Compromise
- NIST AI RMF
- MAP 4.1
- EU AI Act
- Annex III §2
- ISO/IEC
- TR 24028; 42001; 23894
- AIUC-1
- B. Security
- Scope
- tool failure
- Mitigation
- Scan dependencies and container images for vulnerabilities; Use trusted sources.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
Chrome users with Gemini before 143.0.7499.192 who install a malicious extension
Capability abused
Defense & remediation
Recorded defense
Chrome extension sandbox and privileged-page isolation (insufficient policy enforcement in the WebView tag)
Guardrail kinds
Sandbox isolation, Abuse detection
Guardrail outcome
Silent
Fix shipped
Chrome 143.0.7499.192/.193, January 2026
Taxonomy & references
Curator notes
Found by Gal Weizman (Palo Alto Networks Unit 42), reported 2025-11-23, CVSS 8.8. The AI panel is a browser-internal privileged surface holding capabilities (camera, mic, filesystem, screen capture) far beyond a web page's; the extension used declarativeNetRequest to get script into it. Illustrates that the agent's own UI surface is now a privilege boundary. Researcher writeup by Unit 42 is not used as the source here; THN carries the CVE text verbatim.
Cite as
Enkrypt AI. "CVE-2026-0628: malicious Chrome extension injects script into the privileged Gemini Live panel to reach camera, mic, files and screenshots". AIR, AIR-2026-0055. https://agentincident.vercel.app/i/AIR-2026-0055/ (accessed 2026-10-19).