// GeminiHIGH
Forever Security researcher Gal Weizman disclosed the BragJack attack, demonstrating how malicious browser extensions could hijack Gemini through CVE-2026-0628, a vulnerability in Chrome's Gemini side panel. By manipulating network requests using the declarativeNetRequest API, an extension could access browser capabilities (files, screenshots, camera, microphone) without additional user interaction. Google patched the flaw and awarded a $7,000 bounty; the researcher also identified related vulnerabilities in other AI assistants (Perplexity, Edge, Claude) and received over $20,000 in total bounties.
- Malicious browser extensions can hijack AI assistants - Security(opens in a new tab)
- Google Chrome Gemini AI bug CVE-2026-0628 allowed extension scri(opens in a new tab)
// Get alerts for Gemini