Single Browser Extension Can Hijack Multiple AI Assistants
Security flaw exposes five Chromium-based AI assistants to potential attacks.
1Multi-platform AI vulnerability
Forever Security demonstrated how a single browser extension could compromise AI assistants in five Chromium-based products: Chrome's Gemini Live, Perplexity Comet, Microsoft Edge, Opera Neon, and Claude in Chrome. The attack requires the malicious extension to be pre-installed, after which it can hijack the AI's functionality. On Chrome and Comet, it gains file system access, while Chrome uniquely exposes camera and microphone controls. All targeted products share a common architecture where the AI's 'body' component executes commands within the browser environment.
2Attack mechanism explained
The exploit works by manipulating the trusted webpage that the AI's browser component communicates with. Using just two common permissions - webpage modification (like ad blockers) and declarativeNetRequest - the extension injects malicious code into the trusted domain. This allows it to impersonate legitimate AI vendors and issue commands. The technique bypasses normal security boundaries by exploiting the AI's dual-component architecture where the 'brain' runs remotely while the 'body' operates locally with elevated privileges.
3Varying severity across platforms
Perplexity Comet represented the worst-case scenario with its fully AI-driven browser architecture granting extensive system access. Claude in Chrome was the least severe as it's just an extension abusing another extension. Microsoft Edge proved hardest to compromise, requiring two combined vulnerabilities. Opera Neon was the easiest target due to insufficient extension controls on its opera.com domain. The researchers earned $20,500 in total bug bounties across all five vendors.
4Patch status and CVEs
Google addressed the Chrome vulnerability (CVE-2026-0628, severity 8.8/10) in January 2026, while Microsoft fixed Edge's issue (CVE-2026-55945, severity 4.2) in July. The other three findings lack CVEs, though vendors paid bounties. Notably, Opera discovered their vulnerability independently around the same time. As of September 2026, none of these vulnerabilities appear on the U.S. Known Exploited Vulnerabilities catalog, and there's no evidence of real-world exploitation.
5Underlying security challenge
The research highlights a fundamental tension between browser security models and AI integration. By embedding powerful AI agents within browsers, vendors inadvertently recreate privilege escalation pathways that browsers traditionally work to eliminate. This allows low-privilege extensions to access high-privilege AI components. The findings build on previous reports about similar weaknesses in AI-driven browsers throughout 2025-2026.
6Technical specifics of Edge attack
Microsoft's Edge required a sophisticated two-part exploit: first hijacking a marketing page authorized to communicate with Edge AI, then exploiting a race condition timing flaw to manipulate the agent's 'think' and 'act' modes. This complexity reflects Microsoft's efforts to block simpler extension-based attacks. The successful compromise demonstrates how determined attackers can chain multiple weaknesses to bypass enhanced security measures.
7Perplexity Comet's unique risks
As a fully AI-native browser, Comet granted its agent extensive system access including file reading, browsing history retrieval, and screenshot capabilities when compromised. Forever Security bypassed Perplexity's extension controls by targeting an unprotected test subdomain (testing.perplexity.com) rather than the main site. This oversight highlights the security challenges of maintaining consistent protections across all application entry points in complex software systems.
8Security implications
These findings underscore the expanded attack surface created by browser-integrated AI assistants. While all attacks require initial extension installation - a common malware vector - the potential damage is significant. Users should prioritize browser updates (especially Chrome v143.0.7499.192+ and Edge v150.0.4078.48+) and extension audits. The research suggests vendors need to fundamentally rethink how they architect AI components within browsers to maintain security boundaries.
Original article: The Hacker News — Single Browser Extension Can Hijack Multiple AI Assistants