Case gemini-trifecta-tenablePrompt injectionUnited States
Gemini Trifecta: log, search-history and browsing flaws let Gemini exfiltrate user data
Tenable disclosed three Gemini flaws: prompts in User-Agent headers ran when Cloud Assist summarised logs, injected browser-history queries became trusted context, and the browsing tool leaked data. Google fixed all.
HighAttack on AIStatus: PatchedVerified case file
Open in the interactive mapCite this case
- Reported
- Sep 30, 2025
- Location
- United States
- Target
- Google Gemini (Cloud Assist, Search, Browsing Tool)
- Severity
- High
- Triggered by
- Tenable Research
- Actor type
- Security researchers
- Reported loss
- None reported
- CVE
- None
What happened
Tenable disclosed three Gemini flaws: prompts in User-Agent headers ran when Cloud Assist summarised logs, injected browser-history queries became trusted context, and the browsing tool leaked data. Google fixed all.
Impact: Potential exposure of saved information and location data and compromise of cloud resources for Gemini users; no exploitation reported
Who triggered it
Actor: Tenable Research
Attribution: Responsible disclosure to Google; remediated before publication
Motive: Security research
How it happened
Attack vector: Poisoned HTTP log entries, JavaScript that injects queries into a victim's Chrome history, and prompts that make the browsing tool embed saved locations in outbound requests
Root cause: Gemini integrations treated logs, search history and web content as trusted context without separation from user intent
Timeline
- Tenable reports the three issues to Google
- Tenable publishes the Gemini Trifecta research after Google remediation
Response
Google stopped rendering hyperlinks in log summaries, hardened the search personalisation model and remediated the browsing tool
Current status: Patched
Sources (open in a new tab)
- Tenable tenable.com
- CSO Online csoonline.com
- iTWire itwire.com
Cite this case
Gemini Trifecta: log, search-history and browsing flaws let Gemini exfiltrate user data. AI Threat Watch, case gemini-trifecta-tenable, Sep 30, 2025. https://aithreat.io/cases/gemini-trifecta-tenable/
Permanent link: https://aithreat.io/cases/gemini-trifecta-tenable/