Chrome’s gemini ai panel silently opened your webcam—google just slammed the hatch

A hole in Chrome’s side-panel for Google’s Gemini AI let any half-baked browser extension turn your laptop into a spy kit. Palo Alto’s Unit 42 caught the flaw, tagged CVE-2026-0628, before the wild knew it existed. Their demo: one click on a poisoned extension and the attacker could film you, scrape every open tab, rummage through local files, and run scripts inside Gemini’s own chrome.

The bait was a bland permission request

Extensions asking only for “read site data” looked harmless. Behind the curtain they piggy-backed on Gemini’s elevated privileges inside the Chromium sandbox. That elevated context, meant to let the AI read the page you’re on without nagging prompts, became a motorway for whatever payload the attacker fancied. Researchers showed the chain live: microphone LED off, camera rolling, Downloads folder copied, screenshotted Gmail in the background.

Google patched in January after a quiet October heads-up. Chrome auto-updates, so most machines are already immune. No banners, no mea-culpa blog post—just a line in the release notes that fixes “a permission issue in the side panel”.

Why the next ai add-on will break something else

Each time Silicon Valley staples a chatbot to an existing surface—search bars, operating systems, now the browser margin—it inherits years of old security assumptions. In this case, Gemini rode Chrome’s internal protocol for side panels, originally scoped for bookmarks and reading lists, not arbitrary code execution. No one re-drew the threat model; attackers did it for them.

The numbers sting: Chrome owns 65 % of desktop browsing. Gemini ships enabled by default to 2 billion profiles. Even a narrow window—three months between disclosure and patch—left a planet-sized attack surface. Palo Alto won’t say if they saw in-the-wild abuse, but the tooling was trivial enough for script kids.

Extensions, meanwhile, keep begging for wider permissions because ad networks pay by the click. Google’s MV3 reform trimmed extension capabilities, yet this vector slipped through. The lesson: if your product operates at ring-zero of the user experience, dress it for ring-zero threats.

Update landed, headlines buried. The webcam light is off—for now. But every new AI convenience is another door waiting for its hinge to be popped.