One Browser Extension Hijacked AI Assistants in Five Products, Researchers Show

Security researchers at Forever Security have demonstrated that a single ordinary browser extension could seize control of AI assistants embedded in five Chromium-based products: Gemini Live in Chrome, Perplexity Comet, Microsoft Edge, Opera Neon, and the Claude in Chrome extension. Once the rogue extension was running, it could commandeer each product's built-in AI agent with just one click. The findings are proof-of-concept demonstrations rather than attacks observed in actual use, and each scenario requires the attacker's extension to already be installed in the victim's browser.

The attacks varied in severity across the five targets. On Comet, Edge, Opera Neon, and Claude in Chrome, the hijacked extension could force the AI agent to act on the attacker's behalf, according to the researchers. On Chrome and Comet, it could also read files stored on the user's computer, while on Chrome it could additionally activate the camera and microphone. Perplexity's Comet browser represented the worst case, Forever Security said, because Comet is a fully AI-driven browser whose agent possessed broad capabilities—once compromised, it could read any file on the machine, list the websites the user had visited, and capture screenshots. The mildest case was Claude in Chrome, which Forever Security described as the least serious finding in the research because one extension was exploiting another extension rather than an extension exploiting a browser core. The researchers earned roughly $20,000 in bug bounties across all five products, with Chrome paying $7,000, Comet $7,000, Edge $5,000, Opera Neon $900, and Claude in Chrome $600. Only two of the vulnerabilities received official CVE identifiers: CVE-2026-0628 for Chrome, rated 8.8 out of 10 by CISA, and CVE-2026-55945 for Edge, rated 4.2. Google patched Chrome in early January 2026 with version 143.0.7499.192, while Microsoft fixed Edge on July 2 with version 150.0.4078.48.

The technique exploited how AI assistants in these browsers are structured. According to Forever Security, each AI has a "body" inside the browser that can see the screen, open files, use the camera, and perform actions, and a "brain" that runs on the company's servers and instructs the body what to do. The body is designed to accept commands only from one trusted web page, such as gemini.google.com for Chrome or perplexity.ai for Comet, and an extension isn't supposed to be able to command that body because extensions can modify web pages but not control the browser itself. Forever Security's method was to take over the trusted page that the body listens to and, through it, deliver its own instructions. The extension needed only two common permissions: one that modifies web pages, which ad blockers routinely use, and another called declarativeNetRequest that alters the browser's network traffic. Together, these permissions let the extension insert its own code into the trusted page and communicate with the AI as though it were the legitimate vendor.

The common thread across all five cases, Forever Security said, is that embedding an AI agent inside the browser reopens a pathway that browsers work hard to shut down, permitting a low-privilege extension to reach a high-privilege component of the browser. As of September 16, 2026, neither CVE appeared on the U.S. Known Exploited Vulnerabilities catalog, and no public evidence showed any of the five methods being used in real attacks. Every scenario assumes the attacker has already persuaded the user to install the malicious extension, the same starting point as many other browser-based attacks. For the two products with official CVE numbers, the fix is to update Chrome to version 143.0.7499.192 or later and Edge to version 150.0.4078.48 or later, while users of Comet, Opera Neon, and Claude in Chrome should ensure their software is current and review installed extensions. The browser extension threat model assumed the worst an extension could do was manipulate content inside web pages, but AI agents that can act on behalf of users and access system resources blur that boundary in ways vendors are still learning to defend.