News

Security researchers have detailed a now-corrected flaw in Google Chrome that might have allowed attackers to elevate their privileges and read files on a user’s computer. Tracked as CVE-2026-0628 and rated 8.8 by CVSS, the problem stemmed from weak policy enforcement related to Chrome’s WebView tag and was fixed by Google in early January 2026.

Google rolled out the patch in Chrome builds 143.0.7499.192/.193 for Windows and macOS and 143.0.7499.192 for Linux. The NIST National Vulnerability Database summarizes the issue as insufficient enforcement of WebView tag policies that, before these releases, could enable a threat actor who tricked a user into installing a malicious extension to inject scripts or HTML into a privileged page. See the official NVD entry: https://nvd.nist.gov/vuln/detail/CVE-2026-0628.

Palo Alto Networks Unit 42 researcher Gal Weizman discovered and reported the bug on November 23, 2025. According to Unit 42, the vulnerability could let an extension with otherwise minimal permissions take control of Chrome’s new Gemini Live panel – the AI assistant pane that appears when users click the Gemini icon at the top of the browser. Google introduced Gemini into Chrome in September 2025.

If exploited, an attacker could have used a crafted extension to achieve privilege escalation through that panel, gaining the ability to access the camera and microphone without explicit consent, capture screenshots of arbitrary webpages, and read local files. In short, the injected code could interact with privileged functionality exposed to the Gemini app hosted in the browser panel.

The incident underscores a broader concern: embedding AI-driven, agentic features directly inside browsers to offer on-the-fly summaries, translations, and automated actions expands the attack surface. Those same agentic capabilities that automate multi-step tasks can be abused to perform actions that ought to be blocked by the browser security model.

At the heart of the danger is the need to grant these AI agents elevated access to browser internals so they can carry out complex operations. A malicious web page or hidden prompt could coerce the agent into taking actions that bypass usual protections, potentially resulting in data theft or remote code execution. Worse, the webpage might persuade the agent to keep the malicious instructions in memory, allowing the unwanted behavior to persist across sessions.

Unit 42 warned that adding an AI side panel inside a browser reintroduces traditional browser attack vectors. Weizman explained that placing such a component inside a high-privilege browser context risks creating new logical errors and implementation weaknesses – for example, issues that could enable cross-site scripting (XSS), privilege escalation, or side-channel attacks exploitable by lower-privileged sites or extensions.

Successful exploitation of CVE-2026-0628 effectively bypassed Chrome’s intended security boundaries and permitted arbitrary code execution at “gemini.google[.]com/app” via the panel, allowing access to sensitive data. Unit 42 noted that an extension relying on the declarativeNetRequest API with a minimal permission set could have been leveraged to inject JavaScript into the Gemini panel.

For context, the declarativeNetRequest API lets extensions observe and modify properties of HTTPS requests and responses and is commonly used by ad-blockers to prevent ads from loading. In this scenario, that API’s capabilities were sufficient – when combined with the WebView policy gap – to influence the browser-embedded Gemini app.

Put simply: an attacker needed only to trick a user into installing a specially crafted extension. That extension could then inject arbitrary scripts into the Gemini side panel, interact with the file system, capture screenshots, and activate camera or microphone functions – actions that the AI assistant might legitimately use to fulfill user queries.

Unit 42 emphasized the distinction between extensions affecting web content (which is expected) and extensions manipulating components that are integrated into the browser itself (which is a serious security risk). When an internal browser component like the Gemini panel is treated like ordinary webpage content, it creates a dangerous gap between intended behavior and a security vulnerability.