Chrome's ai sidekick gemini opened the door to webcam hijacks via rogue extensions

A hole in Chrome’s baked-in Gemini panel handed any half-decent browser extension a skeleton key to the user’s camera, microphone and local files, Palo Alto Networks warns. Unit 42 reverse-engineered the flaw—tagged CVE-2026-0628—after watching a routine «read-only» add-on quietly inject JavaScript into Google’s AI sidebar and inherit its elevated privileges. One click on a cat-meme toolbar was enough to start recording, screenshot every tab and rummage through the Downloads folder.

How a polite sidebar became a privileged spy

Google markets the Gemini side panel as frictionless help: ask the model without leaving the page. The catch is that the panel runs inside Chrome’s highest-permission process to render answers fast. Palo Alto proved that the bridge between extension API and Gemini’s internal origin lacked a same-origin check. Malicious extensions merely had to declare the broad sidePanel permission—something millions already do for legitimate tools—to slip code into that trusted context.

From there the attacker inherits Chrome’s own camera and file-system tokens. Unit 42’s demo script activated the webcam, snapped desktop screenshots and listed every document in the user’s home folder, all while the browser’s security chip remained green. No additional bug chain required.

Google patched in silence, but the clock ticked for three months

Unit 42 shared a working exploit with Google on 4 Oct 2023. The Chromium team confirmed it within 48 h, ranked it high severity, yet waited until the 23 Jan 2024 stable-channel push to ship the fix. Chrome installations autoupdate, so most endpoints are now immune, but the lag leaves a question: how many zero-day extensions already milked the gap?

Google declined to say whether it detected in-the-wild abuse. Telemetry inside the browser, however, would not have caught silent file reads or background microphone streams because the traffic looked like Gemini itself.

Ai features keep outrunning the security model

Browser engineers keep bolting on generative sidebars, compose buttons and real-time copilots. Each shortcut short-circuits the same-origin sandbox in the name of user convenience. Palo Alto’s report is the third this year showing that AI surfaces create new trust boundaries faster than threat models can catch up.

Enterprises that allowed Gemini by policy should audit extension inventories now; a single sideloaded helper can still resurrect the attack vector on any machine that lags one patch behind. For everyone else, the simplest defence is also the oldest: strip extensions to the bare minimum and restart the browser once it nags for a relaunch. The update is already in the wild—refusing it is the only user error left.