Chrome flaw let extensions hijack Gemini’s camera, mic, and file access

Researchers disclosed CVE-2026-0628, a flaw in Chrome’s Gemini "Live in Chrome" side panel that allowed basic-permission extensions to tamper with gemini.google.com/app traffic and inject code into a privileged assistant context, enabling actions such as local file enumeration, screenshots, and camera/microphone activation; Google patched the issue in January 2026 and users are advised to update, limit extensions, and monitor for anomalous camera/screenshot activity.