Gemini Live in Chrome Hijacking (CVE-2026-0628)
Date: 2026-01
Affected: Gemini Live in Chrome Hijacking (CVE-2026-0628)
Attack vector: rce
Category: real-world
Severity: High
CVE: CVE-2026-0628

CVSS 8.8. Insufficient policy enforcement in Chrome's WebView tag allowed malicious browser extensions with only basic permissions to hijack the Gemini Live panel. Access camera/microphone without consent, take screenshots of any website, access local files. Discovered by Palo Alto Unit42. Patched in Chrome 143.0.7499.192.


Mitigations:

Architectural layers (MAESTRO):