al-ice.ai

Chrome 148 — On-Device AI Model Installed Silently, Exposed to Any Webpage via Prompt API

Security by al-ice.ai Editorial

AI relevance: Chrome's built-in on-device LLM changes the threat model for web browsing — any webpage can invoke the model via the Prompt API, creating a new attack surface for prompt injection, data leakage through model side-channels, and unconsented AI inference on user devices.

What happened

  • Chrome 148, releasing May 6, 2026, enables on-device AI model download by default on desktop — no explicit user consent is required.
  • The model ships in two variants: a ~2.7 GB CPU-optimized version and a ~4.0 GB GPU-optimized version. Chrome checks for at least 22 GB free disk space on the data directory volume.
  • When the #optimization-guide-on-device-model and #prompt-api-for-gemini-nano flags are active (now the default), any webpage can trigger model download and inference through the LanguageModel.create() Prompt API.
  • The model is installed per OS user — in multi-user environments (VDI, shared workstations), each user account independently consumes ~4 GB of storage.
  • The change reached 809+ upvotes and 569 comments on Hacker News, with significant pushback from enterprise admins and privacy advocates.

Why it matters

  • Webpage access to local LLMs means any visited site can run inference on your machine — potentially using the model to fingerprint your system, extract information through crafted prompts, or perform covert data analysis.
  • On-device models that process user input create new side-channel attack vectors — timing analysis, output behavior differences, and cache states can leak information about user behavior and data patterns.
  • The per-user installation model multiplies storage impact in enterprise and VDI environments — one commenter estimated 15 TB of additional storage across their VDI fleet.
  • Silent installation of AI model weights shifts the supply-chain trust boundary — users are running model code they didn't explicitly approve, with no transparency about model training data, safety evaluation, or version pinning.

What to do

  • Enterprise admins: review Chrome 148 rollout policies and consider blocking on-device model downloads via policy flags until the security implications are assessed.
  • Individual users: check chrome://flags for #optimization-guide-on-device-model and #prompt-api-for-gemini-nano if you want to disable the feature.
  • Web developers: audit any use of the Prompt API (LanguageModel.create()) — ensure you're not inadvertently triggering model downloads on visitor devices.
  • Security teams: add on-device model presence to endpoint inventory and monitoring — the model files can serve as an indicator of Chrome 148+ deployment in your environment.

Sources