CVE-2026-0628
CVSS 8.8 HIGH: insufficient policy enforcement in WebView tag in Google Chrome prior to 143.0.7499.192 allowed an attacker who… EPSS 21% (98º percentile).
Vulnerabilità ed exploit
Una vulnerabilità in Google Chrome permetteva a estensioni con permessi minimi di dirottare il pannello Gemini Live. Lo sfruttamento avrebbe potuto causare privilege escalation, accesso a file locali, screenshot e accesso a camera e microfono.
4 fonti · 2 mar
CVSS 8.8 HIGH: insufficient policy enforcement in WebView tag in Google Chrome prior to 143.0.7499.192 allowed an attacker who… EPSS 21% (98º percentile).
The Hacker News
New Chrome Vulnerability Let Malicious Extensions Escalate Privileges via Gemini Panel
Chrome CVE-2026-0628 let malicious extensions hijack Gemini panel for privilege escalation, local file access, and surveillance.
originaleSecurityWeek
Vulnerability Allowed Hijacking Chrome’s Gemini Live AI Assistant
Malicious extensions could hijack the Gemini Live in Chrome feature to spy on users and steal their files.
originaleUnit 42
Taming Agentic Browsers: Vulnerability in Chrome Allowed Extensions to Hijack New Gemini Panel
A high-severity CVE-2026-0628 in Chrome's Gemini allowed local file access and privacy invasion.
originalePart of the PlainSec briefing for 2026-03-03
Every edition of this story: Estensioni Maligne Potevano Dirottare il Pannello Gemini di Chrome