AdvisoriesToolsStatsChecklistSubmitGet the email
← All advisories
VV-025highPrompt injection2025-09-30

Gemini Trifecta: three injection flaws in Google’s Gemini suite

Tenable found three now-fixed vulnerabilities in Gemini Cloud Assist, the Search Personalization model and the Browsing tool that exposed users to privacy risks, including search-injection.

01.

What it is

Published 30 September 2025. Each flaw let attacker-controlled content act as instructions to Gemini.

02.

How to check

  1. No user patch; Google remediated server-side.
03.

How to fix

  1. Limit what Gemini integrations can read in Google Cloud and Workspace.
04.

Sources

More advisories for this tool
The weekly email

One email a week. Only what changed.

New advisories, CVEs and fixes for Lovable, Bolt, v0, Replit, Base44 and Cursor apps. No roundups of things you already read.

Free. The list is new, so the first issues go out once there are readers. Unsubscribe from any email in one click. We never sell or share addresses.