Chrome Gemini Vulnerability Lets Attackers Access Victims’ Camera and Microphone Remotely

A high-severity vulnerability (CVE-2026-0628) in Google Chrome’s integrated Gemini AI panel allowed malicious browser extensions to inject JavaScript into the privileged Gemini side panel via the declarativeNetRequest API, enabling silent activation of camera and microphone, screenshots, access to local files, and trusted-panel phishing. Discovered by Unit 42 and responsibly disclosed to Google, a patch was released on 2026-01-05; organizations and users are advised to update Chrome immediately to mitigate the risk.