Malicious Browser Extension Could Hijack AI Assistants in Five Chromium Products

Security researchers at Forever Security have demonstrated a technique that could allow a single malicious browser extension to take control of AI assistants built into five Chromium based products: Gemini Live in Chrome, Perplexity Comet, Microsoft Edge, Opera Neon, and Claude in Chrome.

The demonstrations showed that an already installed extension could interact with the AI systems without requiring additional user clicks.

Depending on the product, the attack could allow an extension to control an AI agent, access local files, read browser information, take screenshots, or activate the camera and microphone.

The researchers emphasized that these were demonstrations and not attacks observed in the wild. The attack also requires the malicious extension to already be installed and running in the victim's browser.

How the Attack Works

The affected AI products use a combination of browser capabilities and cloud based AI systems.

The AI assistant has a local component inside the browser that can interact with webpages, files, and other browser capabilities. A remote AI system acts as the decision making component and sends instructions to the local part.

Normally, the local AI component accepts commands only from a specific trusted webpage controlled by the vendor.

Forever Security found that a browser extension could potentially take control of that trusted webpage and use it to communicate with the AI assistant.

The researchers said the extension needed only two common browser permissions:

• Permission to modify webpages.
• The declarativeNetRequest permission, which can modify browser network requests.

By combining these permissions, the extension could inject code into a trusted webpage and communicate with the AI system as though the commands were coming from the vendor's own page.

Chrome Vulnerability

The Chrome case was previously reported by Forever Security researcher Gal Weizman under the name GlicJack.

Google fixed the vulnerability in January 2026 with Chrome 143.0.7499.192.

The issue is tracked as CVE-2026-0628 and has a CVSS score of 8.8 assigned by CISA.

The demonstrated attack could allow a malicious extension to access sensitive browser and device capabilities, including local files, screenshots, and camera and microphone access.

Other Products Also Affected

Forever Security later reported similar attack techniques affecting Perplexity Comet, Microsoft Edge, Opera Neon, and Claude in Chrome.

Only the Edge vulnerability received a CVE identifier:

CVE-2026-55945

Microsoft fixed the Edge issue in version 150.0.4078.48, released on July 2, 2026. The vulnerability has a CVSS score of 4.2.

The researchers said the Comet, Opera Neon, and Claude in Chrome findings did not have CVE identifiers at the time of their report.

Forever Security said it received approximately $20,500 in bug bounty payments across the five products.

Capabilities Demonstrated

The researchers reported the following capabilities:

CapabilityChromeCometEdgeOpera NeonClaude in ChromeRead local filesYesYesNoNoNoCamera and microphoneYesNoNoNoNoControl AI agentNoYesYesYesYesAccess browser profileYesYesNoNoNoRead browsing historyNoYesNoNoNoTake screenshotsYesYesNoNoNoAdditional clicks requiredNoNoNoNoNo

All five demonstrations could reportedly operate without requiring additional clicks once the malicious extension was active.

Perplexity Comet Had Broadest Capabilities

According to the researchers, Perplexity Comet presented the broadest impact because it was designed as an AI driven browser.

After hijacking the AI agent, the researchers demonstrated the ability to:

• Read files from the computer.
• List websites visited by the user.
• Take screenshots.
• Perform actions on behalf of the user.

Forever Security said Perplexity had already blocked extensions from its primary website. The researchers instead used a testing subdomain that had not been restricted in the same way.

Claude in Chrome Considered Lower Severity

The researchers described the Claude in Chrome finding as the least serious of the five cases.

Unlike the other products, Claude in Chrome is itself a browser extension rather than a complete browser.

The researchers said the issue therefore involved one extension abusing another extension rather than a browser extension gaining control of an entire browser.

Anthropic classified the issue as medium severity and paid a bug bounty.

The report also noted that other security researchers had previously identified related weaknesses involving Claude in Chrome.

Edge Required Multiple Weaknesses

Microsoft Edge was reportedly more difficult to compromise.

According to Forever Security, Microsoft had implemented protections against the extension technique. The researchers combined two weaknesses to demonstrate the attack.

They first took control of a Microsoft marketing page that was permitted to communicate with the Edge AI system.

They then exploited a race condition to switch the AI agent between its reasoning and action states at a specific moment, causing it to execute an attacker controlled prompt.

Opera Neon Attack

The researchers said Opera Neon was comparatively straightforward to manipulate.

The AI assistant trusted pages hosted on opera.com, and the researchers found that extensions were able to execute code on the relevant page.

This allowed the extension to communicate with the AI assistant through the trusted webpage.

Forever Security said Opera independently discovered the same issue around the same time but still provided a bug bounty.

No Evidence of Real World Exploitation

As of September 16, 2026, the researchers said there was no public evidence that any of the five demonstrated techniques had been used in real world attacks.

Neither CVE was listed in the U.S. Known Exploited Vulnerabilities catalog at that time.

The attack also requires an important initial condition: the victim must already have the malicious extension installed and running.

This makes extension security an important part of protecting AI enabled browsers.

Security Recommendations

Users should:

• Keep Chrome, Edge, Comet, Opera Neon, and Claude in Chrome updated.
• Update Chrome to 143.0.7499.192 or later.
• Update Edge to 150.0.4078.48 or later.
• Review installed browser extensions regularly.
• Remove extensions that are unnecessary or no longer trusted.
• Avoid installing extensions from unknown developers or untrusted sources.
• Treat extensions requesting broad webpage or network permissions with caution.

The findings highlight a broader security concern around AI agents embedded directly into browsers. A low privilege browser extension can potentially become a pathway to higher privilege AI capabilities when those systems trust specific webpages as their command interface.

Malicious Browser Extension Could Hijack AI Assistants in Five Chromium Products

Security researchers at Forever Security have demonstrated a technique that could allow a single malicious browser extension to take control of AI assistants built into five Chromium based products: Gemini Live in Chrome, Perplexity Comet, Microsoft Edge, Opera Neon, and Claude in Chrome.

The demonstrations showed that an already installed extension could interact with the AI systems without requiring additional user clicks.

Depending on the product, the attack could allow an extension to control an AI agent, access local files, read browser information, take screenshots, or activate the camera and microphone.

The researchers emphasized that these were demonstrations and not attacks observed in the wild. The attack also requires the malicious extension to already be installed and running in the victim's browser.

How the Attack Works

The affected AI products use a combination of browser capabilities and cloud based AI systems.

The AI assistant has a local component inside the browser that can interact with webpages, files, and other browser capabilities. A remote AI system acts as the decision making component and sends instructions to the local part.

Normally, the local AI component accepts commands only from a specific trusted webpage controlled by the vendor.

Forever Security found that a browser extension could potentially take control of that trusted webpage and use it to communicate with the AI assistant.

The researchers said the extension needed only two common browser permissions:

• Permission to modify webpages.
• The declarativeNetRequest permission, which can modify browser network requests.

By combining these permissions, the extension could inject code into a trusted webpage and communicate with the AI system as though the commands were coming from the vendor's own page.

Chrome Vulnerability

The Chrome case was previously reported by Forever Security researcher Gal Weizman under the name GlicJack.

Google fixed the vulnerability in January 2026 with Chrome 143.0.7499.192.

The issue is tracked as CVE-2026-0628 and has a CVSS score of 8.8 assigned by CISA.

The demonstrated attack could allow a malicious extension to access sensitive browser and device capabilities, including local files, screenshots, and camera and microphone access.

Other Products Also Affected

Forever Security later reported similar attack techniques affecting Perplexity Comet, Microsoft Edge, Opera Neon, and Claude in Chrome.

Only the Edge vulnerability received a CVE identifier:

CVE-2026-55945

Microsoft fixed the Edge issue in version 150.0.4078.48, released on July 2, 2026. The vulnerability has a CVSS score of 4.2.

The researchers said the Comet, Opera Neon, and Claude in Chrome findings did not have CVE identifiers at the time of their report.

Forever Security said it received approximately $20,500 in bug bounty payments across the five products.

Capabilities Demonstrated

The researchers reported the following capabilities:

CapabilityChromeCometEdgeOpera NeonClaude in ChromeRead local filesYesYesNoNoNoCamera and microphoneYesNoNoNoNoControl AI agentNoYesYesYesYesAccess browser profileYesYesNoNoNoRead browsing historyNoYesNoNoNoTake screenshotsYesYesNoNoNoAdditional clicks requiredNoNoNoNoNo

All five demonstrations could reportedly operate without requiring additional clicks once the malicious extension was active.

Perplexity Comet Had Broadest Capabilities

According to the researchers, Perplexity Comet presented the broadest impact because it was designed as an AI driven browser.

After hijacking the AI agent, the researchers demonstrated the ability to:

• Read files from the computer.
• List websites visited by the user.
• Take screenshots.
• Perform actions on behalf of the user.

Forever Security said Perplexity had already blocked extensions from its primary website. The researchers instead used a testing subdomain that had not been restricted in the same way.

Claude in Chrome Considered Lower Severity

The researchers described the Claude in Chrome finding as the least serious of the five cases.

Unlike the other products, Claude in Chrome is itself a browser extension rather than a complete browser.

The researchers said the issue therefore involved one extension abusing another extension rather than a browser extension gaining control of an entire browser.

Anthropic classified the issue as medium severity and paid a bug bounty.

The report also noted that other security researchers had previously identified related weaknesses involving Claude in Chrome.

Edge Required Multiple Weaknesses

Microsoft Edge was reportedly more difficult to compromise.

According to Forever Security, Microsoft had implemented protections against the extension technique. The researchers combined two weaknesses to demonstrate the attack.

They first took control of a Microsoft marketing page that was permitted to communicate with the Edge AI system.

They then exploited a race condition to switch the AI agent between its reasoning and action states at a specific moment, causing it to execute an attacker controlled prompt.

Opera Neon Attack

The researchers said Opera Neon was comparatively straightforward to manipulate.

The AI assistant trusted pages hosted on opera.com, and the researchers found that extensions were able to execute code on the relevant page.

This allowed the extension to communicate with the AI assistant through the trusted webpage.

Forever Security said Opera independently discovered the same issue around the same time but still provided a bug bounty.

No Evidence of Real World Exploitation

As of September 16, 2026, the researchers said there was no public evidence that any of the five demonstrated techniques had been used in real world attacks.

Neither CVE was listed in the U.S. Known Exploited Vulnerabilities catalog at that time.

The attack also requires an important initial condition: the victim must already have the malicious extension installed and running.

This makes extension security an important part of protecting AI enabled browsers.

Security Recommendations

Users should:

• Keep Chrome, Edge, Comet, Opera Neon, and Claude in Chrome updated.
• Update Chrome to 143.0.7499.192 or later.
• Update Edge to 150.0.4078.48 or later.
• Review installed browser extensions regularly.
• Remove extensions that are unnecessary or no longer trusted.
• Avoid installing extensions from unknown developers or untrusted sources.
• Treat extensions requesting broad webpage or network permissions with caution.

The findings highlight a broader security concern around AI agents embedded directly into browsers. A low privilege browser extension can potentially become a pathway to higher privilege AI capabilities when those systems trust specific webpages as their command interface.