gemma-gem-browser-ai

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 1.00). The offscreen agent explicitly calls the content-script tool read_page_content (content/tools/executor.ts reads document.body.innerText or selector textContent) and ingests page text/HTML from arbitrary web pages as part of its agent loop (agent/loop.ts), which can then drive tool calls like click_element and run_javascript — exposing it to untrusted third‑party content that can indirectly inject instructions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The extension loads ONNX models at runtime from the Hugging Face model hub (e.g. https://huggingface.co/onnx-community/gemma-4-E2B-it-ONNX and https://huggingface.co/onnx-community/gemma-4-E4B-it-ONNX), which are fetched on first use and directly determine the agent's generated tokens/tool-calls, so these external model files are runtime dependencies that control the agent's behavior.