Google’s integration of Gemini Nano into Chrome creates an unmonitored AI runtime accessible to any website, introducing prompt injection and parasitic compute risks that bypass traditional cloud security controls. By Kirill Gelfand , Vladimir Kropotov , Fyodor Yarochkin , David Tulis.
Engineering leaders must now treat every managed Chrome desktop as an exposed AI runtime. Google’s recent deployment of the 4.27 GB Gemini Nano model to qualifying installations fundamentally alters the threat landscape. Unlike cloud-hosted APIs, this local model lacks authentication tokens, audit logs, and rate limits. Once downloaded, any HTTPS site can invoke it via JavaScript without user consent or visible indicators. This design inversion removes the privilege boundaries that typically protect enterprise data.
We demonstrated successful prompt injection of Chrome’s built-in AI workflows: We showed how text on a webpage, when processed by Chrome’s Summarizer and Writer APIs, and Chrome’s former on-device Scam Detector (since replaced by a cloud model in Chrome 156), can redefine tasks and change the intended behavior of the local models. A core problem is that trusted instructions and untrusted content ultimately have to be interpreted by the same language model.
The immediate technical risk is prompt injection. Because system prompts and webpage content share the same context window without enforced authority, malicious scripts can manipulate AI features like Summarizer or Writing Assistance. TrendAI Research demonstrated that plausible-sounding payloads could bypass scam detection mechanisms, flipping classification fields that feed server-side verdicts. While Chrome 156 moves scam detection to the cloud, the underlying architectural vulnerability remains for other on-device features.
Beyond data integrity, the model enables parasitic computing. Websites can silently use user hardware for inference, creating economic incentives for abuse similar to cryptomining. With throughput reaching 30 tokens per second on mid-range devices, the cost savings for attackers are significant. However, unlike cryptomining, browsers currently lack throttling or blocking mechanisms for this specific vector.
For CISOs, the challenge is visibility. Current enterprise policies cannot distinguish between legitimate user interaction and malicious script-driven inference. Developers must implement strict input sanitization, treating model output as untrusted data to prevent XSS and injection attacks. Application-level rate limiting is essential, as the browser provides no per-origin controls. Until Google enforces privilege boundaries and ships granular enterprise controls, organizations must assume that any visited website can leverage local AI resources without oversight. Good read!
[Read More]