Public story · 2026-03-12 · source-backed
CVE-2026-0628: Chrome Gemini Panel Hijacked via Basic Extension Permissions.
Story
Unit 42 found extensions with only declarativeNetRequests could access cameras, mics, and local files through Chrome's Gemini panel. Third independent agentic browser vulnerability family. This is a design flaw, not a bug. Unit 42
Related stories
Each link below shares sources, entities, or timing with this story.
Shared entities / Same source / Shared topic / Earlier coverage
CVE-2026-0628: Chrome Gemini Panel Hijacking Creates a New AI Privilege Escalation Class
Both cover Chrome, CVE, Gemini, Unit; cite the same source (Unit 42); overlapping topics (access, basic, browser, chrome, extension).
Shared entities / Shared topic / What happened next
Gemini 3.5 Flash hit GA as Google's fast model for agentic and coding work.
Both cover Chrome, Gemini; overlapping topics (agentic, chrome, gemini); picks up the Chrome thread on 2026-06-28.
Shared entities / Shared topic / Earlier coverage
Sundar Pichai: Gemini 3 Pro Fastest-Adopted Model, 750M Monthly Users
Both cover Chrome, Gemini; overlapping topics (agentic, chrome, gemini); earlier Chrome coverage from 2026-02-12.
Shared entity: Chrome / Shared topic / Earlier coverage / Tension
WebMCP: Chrome's Sleeper Hit
Both cover Chrome; overlapping topics (access, browser, chrome); earlier Chrome coverage from 2026-02-26.
Shared entity: Unit / Same source domain / What happened next / Tension
Unit 42: First In-the-Wild Indirect Prompt Injection Against Deployed Agents.
Both cover Unit; reported by the same outlet (unit42.paloaltonetworks.com); picks up the Unit thread on 2026-03-15.
Shared entity: Chrome / Shared topic / What happened next / Tension
Lightpanda: Zig Headless Browser for AI Agents
Both cover Chrome; overlapping topics (browser, chrome); picks up the Chrome thread on 2026-03-14.
Shared entity: Chrome / Shared topic / What happened next
Codex CLI v0.130 Ships Remote Control, Computer Use, and a Browser Extension
Both cover Chrome; overlapping topics (browser, chrome, extension); picks up the Chrome thread on 2026-05-18.
Shared entity: Gemini / Shared topic / What happened next
Google I/O 2026 set for May 19. Gemini 4, Android 17, and XR glasses expected.
Both cover Gemini; overlapping topics (agentic, could, gemini); picks up the Gemini thread on 2026-05-11.
Source trail
Entities
Provenance
- Canonical issue
- Ramsay Research Agent — 2026-03-12
- AI generated
- no
- Story unit
- 2026-03-12-cve-2026-0628-chrome-gemini-panel-hijacked-via-basic-extension-permissions
- Labels
- source-backed, canonical briefing excerpt