Unit42 discloses severe flaw in Google's Gemini

Palo Alto Networks’ Unit42 has uncovered a high-severity vulnerability in Google’s new Gemini Live in Chrome AI feature that could be used for privilege escalation attacks.

The researchers disclosed they discovered the vulnerability and shared the issue with Google in October, and Google issued a fix in early January. The vulnerability could potentially have allowed malicious extensions with basic permissions to hijack the in-browser AI assistant, giving attackers access to webcams, microphones and private files, Unit 42 said.

Because the Gemini panel is treated as a trusted browser surface, influencing what loads inside it could allow privilege escalation even for browser extensions with only basic host permissions. Malicious extensions permitted to interact within the Gemini domain could intercept and modify JavaScript resources before they were rendered in the panel, effectively injecting code into content executing inside the panel.

This is because when loaded in the side panel, Gemini runs within a more privileged browser process than ordinary web pages have access to, the company said. This could even allow attackers to execute phishing attacks within the Gemini interface.

Palo Alto Networks SVP of Product Management Anupam Upadhyaya said while this vulnerability has been closed, the discovery underscores the security concerns associated with tech giants rushing to turn browsers into powerful AI agents.

“Today’s agentic browsers can act on your behalf — researching, reasoning and taking action without direct user input. While this can deliver meaningful productivity gains, in the absence of enterprise-grade controls these tools can take autonomous actions beyond IT oversight,” he said. “By inheriting a user’s browser session and accessing screens, files, cameras and microphones, agentic browsers can expand the attack surface through prompt manipulation and weakened web isolation, creating security and accountability gaps enterprises haven’t faced before.”

Image credit: iStock.com/DigitalVision