Google Gemini Vulnerabilities Let Hackers Steal Saved Data and Live Location

Three critical vulnerabilities were discovered in the Gemini AI assistant suite by Google, known as the "Gemini Trifecta." These vulnerabilities could have allowed unauthorized access to users' saved data and live location information. Google has since addressed these security issues.

The vulnerabilities identified by Tenable targeted different components of the Gemini ecosystem:

Gemini Cloud Assist: Vulnerabilities were found allowing attackers to inject malicious prompts via HTTP User-Agent headers in log entries, processed by AI when users requested log summaries.

Gemini Search Personalization Model: Exploitation of this model allowed cybercriminals to inject malicious JavaScript code into users' browsers, manipulating search queries interpreted as legitimate instructions by the AI system.

Gemini Browsing Tool: This flaw allowed attackers to extract user data by directing the AI to visit malicious websites with user information embedded in the URL parameters.

The attack pattern comprised two stages: infiltration and exfiltration. During infiltration, attackers injected malicious prompts through indirect methods, such as log entries or search history manipulation, which appeared legitimate to the AI system. For exfiltration, attackers could instruct Gemini to summarize external websites, causing the AI to make HTTP requests containing sensitive user data to attacker-controlled servers.

Google implemented multiple mitigation strategies to address these vulnerabilities:

In the Cloud Assist vulnerability, modifications were made to how hyperlinks are rendered in log summary responses. The search personalization vulnerability was mitigated by rolling back the affected model and implementing layered prompt injection defenses. For the browsing tool vulnerability, data exfiltration was prevented through indirect prompt injections, ensuring that malicious instructions cannot exploit the tool's web browsing capabilities.

This research underscores the evolving security challenges in AI-powered systems. Organizations adopting AI tools must recognize that these systems create new attack surfaces requiring specialized protection strategies. Traditional cybersecurity approaches may not suffice, as AI systems can be manipulated through prompt engineering rather than traditional exploitation methods.

Organizations deploying AI tools need comprehensive visibility into their AI infrastructure and strict policy enforcement to maintain security.

Based on reporting by GBHackers.