Suspicious Gemini Panel Hijack Extension

Kaung Khant Ko@kaungkhantko

•updated Mar 4, 2026•15•0•142

Detects the installation of a browser extension that requests both the 'declarativeNetRequest' permission and host permissions for 'gemini.google.com'. This specific combination of permissions was the vector for CVE-2026-0628, a vulnerability that allowed an extension to inject code into the privileged Gemini side panel, leading to privilege escalation and unauthorized access to local files, camera, and microphone.