AI browser extensions
Is there a safe Gemini Chrome extension?
Google's "Gemini in Chrome" is built into the browser, not an installable extension - so most "Gemini extension" search results are third-party. Here's what the official feature can access, the real vulnerabilities found in it, and how to spot the fakes.
- Official form
- Built into Chrome, not an installable extension
- Access
- Current tab + up to 10 opt-in tabs, page content, history
- The trap
- Fake "Gemini" extensions (one ~80k installs, removed)
Is there an official Gemini Chrome extension, and is it safe?
Google's official product isn't an extension at all. "Gemini in Chrome" is built into the browser as a toolbar icon and side panel, so there's nothing to install from the Web Store. That matters, because it means most search results for a "Gemini Chrome extension" point to third-party extensions that aren't from Google - and fake "Gemini" extensions have already been caught, including one with roughly 80,000 installs in a data-stealing campaign that Google removed.
The built-in feature is comparatively conservative. It can reference your current tab and up to 10 tabs you opt in, read page content, and use your browsing history. For its agentic "auto-browse" mode, which can act on pages, Google says the model isn't exposed to your passwords or saved cards and the agent pauses for confirmation on sign-ins and final purchases. Google also publishes a security architecture for it, with a separate model that vets each agent action and origin-based access controls.
None of that makes it immune. Researchers found a real, high-severity flaw (CVE-2026-0628) where a low-privilege extension could hijack the Gemini panel to reach the camera, microphone and local files, and LayerX showed that any extension can read or inject the prompt fields of AI tools like Gemini. So: use the built-in Gemini rather than a random "Gemini" extension, keep Chrome updated, and scan the other extensions sharing your browser.
What it can access
- Your current tab, plus up to 10 other tabs you explicitly opt in
- Page content on the tabs it's working with
- Your browsing history, to help with tasks
- In agentic "auto-browse" mode: acting on pages - though Google says it's not exposed to passwords or saved cards and pauses for sign-ins and purchases
What to watch for
- CVE-2026-0628 (Palo Alto Unit 42, high severity): a low-privilege extension could inject into the Gemini Live panel and reach camera, microphone, local files and screenshots. Fixed in Chrome in early 2026
- Man-in-the-Prompt (LayerX): any extension, even with no special permissions, can read or inject the prompt fields of AI tools including Gemini
- Fake "Gemini" extensions: part of the AiFrame campaign, one with ~80,000 installs, removed by Google - the reason not to install a "Gemini extension" from search
- Prompt injection: the category-wide risk for any agent that reads and acts on web content
What Gemini in Chrome can access, permission by permission
How to use Gemini in Chrome safely
The first rule is to use Google's built-in feature, not a Web Store "Gemini" extension. Then keep the surface small.
- 1
Use the built-in feature, not an "extension"
Gemini in Chrome ships inside the browser. If a Web Store listing offers a "Gemini extension", it's third-party - treat it as unverified until proven otherwise.
- 2
Keep Chrome updated
The Gemini panel hijack (CVE-2026-0628) was fixed in a Chrome update. Staying current is what closes flaws like it - don't sit on old versions.
- 3
Opt tabs in deliberately
Only add the tabs a task needs. Fewer tabs in scope means a smaller blast radius if a page tries to inject instructions.
- 4
Scan the extensions you already have
Man-in-the-Prompt showed any extension can read AI prompt fields. Scan every extension in the browser so nothing is quietly reading your Gemini prompts and responses.
- 5
Sweep the fleet for fakes
If staff searched for a "Gemini extension", they may have installed an impostor. Inventory every extension across the org and remove the lookalikes.
The evidence behind this
“A low-privilege extension could inject into the Gemini Live panel and inherit its privileges, reaching camera, microphone, local files and screenshots of any HTTPS tab.”
Palo Alto Networks Unit 42 (CVE-2026-0628)
A real, high-severity flaw in the official feature, disclosed responsibly and fixed in Chrome.
“Any extension, even one with no special permissions, can read and inject the prompt fields of web AI tools including Gemini, ChatGPT, Copilot and Claude.”
LayerX - Man-in-the-Prompt
Why the other extensions in your browser matter as much as the AI feature itself.
“Reputation signals can't see runtime exfiltration - Featured, Verified extensions with hundreds of thousands of installs have shipped users' data anyway.”
The AI Chat Scraping Wall of Shame
Our own research - the case for behavioural scanning over badges.
Frequently asked questions
Is there an official Gemini Chrome extension?
Not as a separate download. Google built Gemini directly into Chrome as a toolbar icon and side panel, so there's no official "Gemini extension" to install from the Web Store. Anything presented that way is third-party. This is the single most important thing to know, because fake "Gemini" extensions have been used to steal credentials and email content.
What can Gemini in Chrome access?
The built-in feature can reference your current tab and up to 10 tabs you opt in, read page content, and use your browsing history. In its agentic auto-browse mode (paid tiers, currently a US preview) it can act on pages, but Google says the model isn't exposed to your passwords or saved cards and the agent pauses for confirmation on sign-ins and final purchases. It's more conservative than some rivals, but it still reads and, in agent mode, acts on web content.
Has Gemini in Chrome had security vulnerabilities?
Yes. Palo Alto's Unit 42 found CVE-2026-0628, a high-severity flaw where a low-privilege extension could inject code into the Gemini Live panel and inherit its privileges - reaching the camera, microphone, local files and screenshots without consent. Google fixed it in a Chrome update in early 2026. Separately, LayerX's Man-in-the-Prompt research showed any installed extension can read or tamper with the prompt fields of AI tools including Gemini.
How do I spot a fake Gemini extension?
Assume any "Gemini" extension in the Web Store is not from Google, because Google doesn't ship one - Gemini is built into Chrome. Check the publisher, be wary of broad "read and change all your data on all websites" permissions, and scan the extension's behaviour before trusting it. Reputation, install counts and badges don't reveal a data-stealing beacon; watching what the code actually does is what catches it.
See what every extension in your browser can actually access.
Free scan of your Google Workspace in under 48 hours.