Loading story…
Palo Alto Networks Unit 42 disclosed a high-severity Google Chrome vulnerability in the new Gemini Live in Chrome side panel, tracked as CVE-2026-0628, that could have allowed malicious browser extensions with only basic permissions to hijack the Gemini panel and effectively “tap into” the browser environment. The reported impact included privilege escalation enabling access to sensitive resources such as the victim’s camera and microphone, the ability to take screenshots of any website, and access to local files and directories. Unit 42 reported responsible disclosure to Google and stated that Google shipped a fix in early January ahead of public disclosure.
Dark Reading coverage echoed Unit 42’s findings, emphasizing that the flaw highlights emerging risks in agentic/AI-enabled browsers where AI side panels run with elevated capabilities, and that enterprise environments face amplified exposure if users install untrusted extensions. Separate reporting described unrelated supply-chain activity affecting developer and browser extensions: Socket reported suspicious, non-repository code added to Aqua Trivy’s VS Code extension on OpenVSX (versions 1.8.12/1.8.13) that attempted to invoke local AI coding assistants and exfiltrate/report data, while Rescana detailed a QuickLens Chrome extension takeover used for credential/crypto theft and a ClickFix social-engineering technique; these are distinct incidents from CVE-2026-0628 but reinforce the broader risk of extension ecosystems.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Unit 42 published technical details for CVE-2026-0628, explaining how Chrome's handling of Gemini in a privileged panel let extensions abuse declarativeNetRequest or WebView policy gaps to hijack the panel. The disclosure highlighted risks including surveillance, phishing, and broader attack-surface expansion from agentic browser features.
Google patched the Gemini Live side-panel vulnerability in early January 2026, shipping fixes in Chrome 143.0.7499.192/.193 on desktop stable channels. The fix closed the privilege-escalation path that could have enabled access to screenshots, local files, camera, and microphone through a malicious extension.
Palo Alto Networks Unit 42 discovered CVE-2026-0628, a high-severity Chrome vulnerability that allowed low-permission extensions to inject code into the privileged Gemini Live side panel, and responsibly disclosed it to Google. Multiple reports place the disclosure on October 23, 2025.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
9 references tracked. Mallory keeps watching after this page renders.
helpnetsecurity.com
Open sourcescworld.com
Open sourcesecurityaffairs.com
Open sourcego.theregister.com
Open sourcethehackernews.com
Open sourcecybersecuritynews.com
Open sourceunit42.paloaltonetworks.com
Open sourcezdnet.com
Open sourcedarkreading.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers reported multiple risks tied to **AI-themed browser extensions** in the Chrome/Edge ecosystem, including active malicious campaigns. Malwarebytes identified **16 malicious extensions** (15 Chrome, 1 Edge) masquerading as ChatGPT “enhancers” that **steal ChatGPT session tokens**, enabling attackers to take over accounts and access conversation history and metadata; the extensions also exfiltrate additional telemetry (e.g., extension version/language and usage details) to help attackers profile victims and maintain longer-term access. Separately, Varonis described a new **malware-as-a-service** offering called **“Stanley”** that claims to reliably get **phishing-capable Chrome extensions** through Chrome Web Store review, using full-screen `iframe` overlays to present attacker-controlled login pages while the address bar continues to show the legitimate domain; it also advertises auto-install support across Chrome/Edge/Brave, a management panel, geo/IP targeting, and frequent C2 polling. In parallel with these overtly malicious cases, an Incogni study of **442 AI-powered Chrome extensions** found broad privacy and security exposure from over-privileged extensions (e.g., script injection and deep page access) and extensive data collection (52% collecting user data), highlighting that even popular tools (e.g., **Grammarly** and **QuillBot**) can present significant privacy risk due to the scope of permissions and data categories collected.
Jun 29, 2026
Security researchers reported a surge in **malicious Chrome extensions** abusing high-privilege browser permissions to steal credentials and hijack authenticated sessions. LayerX identified at least **16 ChatGPT-related extensions** that mimic legitimate productivity tools and brands, then inject scripts into `chatgpt.com` to monitor outbound web requests and **exfiltrate authorization details and session tokens** to attacker-controlled infrastructure. With stolen tokens, attackers can impersonate victims’ ChatGPT sessions and potentially access connected data sources (e.g., integrations with *Slack* and *GitHub*), expanding impact beyond the AI service itself. Separately, Varonis documented a **malware-as-a-service** browser-extension toolkit dubbed **Stanley** being sold on Russian-language cybercrime forums, marketed to enable large-scale credential theft by **showing a phishing site while the URL bar continues to display the legitimate domain**. The toolkit uses a web-based control panel to configure per-victim “source” (legitimate) and “target” (phishing) URLs, then overlays a full-screen iframe to spoof the destination site; the seller also claims “guaranteed” placement in the **Chrome Web Store**, increasing the likelihood of user installation and enterprise exposure.
Jun 29, 2026
Multiple **malicious Chrome/Chromium extensions** were identified abusing the Chrome Web Store to steal data from users and enterprises. Two previously legitimate extensions—**QuickLens** (`kdenlnncndfnhkognokgfpabgkgehodd`) and **ShotBird** (`gengfhhkjekmlejbhmmopegofnoifnjp`)—reportedly turned malicious after **ownership transfers**, enabling downstream compromise through injected code and data harvesting. In the QuickLens case, researchers reported the malicious update preserved expected functionality while adding capabilities to **strip security headers** (e.g., `X-Frame-Options`) and facilitate script injection that can bypass **Content Security Policy (CSP)** protections, expanding the attacker’s ability to make cross-domain requests and collect sensitive information. Separately, Microsoft reported a campaign of **counterfeit “AI assistant” browser extensions** distributed via the Chrome Web Store (and therefore also impacting Microsoft Edge environments that allow Chrome extensions), which allegedly affected **20,000+ enterprise tenants** and amassed roughly **900,000 installs**. These extensions impersonated legitimate AI productivity tools and harvested **ChatGPT/DeepSeek conversation histories**, visited URLs, and browsing telemetry, staging data for exfiltration to attacker-controlled infrastructure. Another Chrome Web Store threat involved a fake **imToken**-branded extension (“lmΤoken Chromophore”) that masqueraded as a benign tool but redirected victims to phishing infrastructure to steal **seed phrases and private keys**, using tactics like hardcoded remote configuration (via JSONKeeper) and decoy navigation to the legitimate `token.im` site after credential capture.
Jun 29, 2026