Gemini threat report

Security researchers at Forever Security demonstrated a vulnerability in Gemini Live (Chrome) where a malicious browser extension using only two common permissions could hijack the AI assistant and access local files, camera, and microphone. The flaw (CVE-2026-0628) was patched by Google in January 2026, but researchers have shown similar vulnerabilities affect multiple AI assistants across Chromium browsers. No active wild exploitation has been reported.