Gemini CLI nightly patches four security bugs at once

Google merged four separate security fixes into the Gemini CLI's v0.60.0-nightly.20260904 release. That kind of density is unusual for this repo. The riskiest of the four for end users is the extension loader's new boundary check. It closes a path malicious extensions could use to read files outside their own install folder.

The MCP OAuth flow now enforces RFC 9207 issuer identification, closing a gap that let a server claim to be an issuer it wasn't.

The macOS Seatbelt sandbox gets its own isolated temporary directory instead of sharing one with other processes.

chrome-devtools-mcp had a hardcoded Google CrUX API key stripped from its source. That key was Google's to rotate, not a risk end users carried.

The release notes don't say whether any of these four came from a bug bounty, an external researcher, or an internal audit. There's no way to tell how long the extension-loader gap existed before this build. Four fixes across four subsystems in one nightly reads, to me, like a coordinated review, though the notes don't confirm that. Anyone running third-party Gemini CLI extensions should update to this build.