Google Adds Layered Defenses to Chrome to Block Indirect Prompt Injection Threats

Google has introduced layered protections in Chrome to counter indirect prompt injection threats generated by untrusted web content, including a new User Alignment Critic that independently checks the agent’s actions after planning. This feature works alongside existing techniques such as spotlighting, which guides the model to follow user and system instructions rather than page-embedded prompts.

It is designed to veto misaligned actions and relies on viewing only metadata, with safeguards intended to prevent poisoning from malicious prompts. Another pillar is Agent Origin Sets, implemented via a gating function that limits the agent’s data access to read-only origins for content consumption and read-writable origins for interactive tasks, thereby reducing cross-origin data leakage.

The system also supports a work log for user observability and requires explicit user approval before navigating to sensitive sites or performing actions like sign-ins or purchases. The U.S. National Cyber Security Centre (NCSC) has noted that large language models can suffer from prompt injection, a risk that Google says will be mitigated through these protections and allied safeguards, including Safe Browsing and on-device scam detection.