CVE-2026-0628: Chrome “Gemini Live” Side Panel Injection Bug

CVE-2026-0628 is a high-severity Chrome/Chromium vulnerability that allows malicious browser extensions to inject script or HTML into the privileged Gemini Live side panel due to insufficient <webview> policy enforcement; vulnerable builds are versions prior to 143.0.7499.192 (with fixes available in 143.0.7499.192/.193 and Extended Stable 142.0.7444.265). The report outlines the extension-led exploitation chain, confirms at least one public proof-of-concept, notes no authoritative confirmation of widespread in-the-wild exploitation, and recommends immediate patching plus stronger extension allowlisting and monitoring as mitigations.