Bug in Google's Gemini AI Panel Opens Door to Hijacking

Google patched CVE-2026-0628, a high-severity flaw in Chrome's Gemini AI side panel that could let malicious extensions with minimal permissions inject JavaScript and escalate privileges to access camera/microphone, take screenshots, and read local files; discovered by Palo Alto Networks Unit 42, the report warns that agentic AI browsers expand the attack surface and calls for native, continuous in-browser security and real-time policy enforcement.