Malicious Browser Extensions Can Hijack AI Assistants
Security researcher exposes vulnerabilities in AI-powered browser tools.
1AI Assistants in Browsers
AI assistants are increasingly integrated into browsers, offering features like webpage summarization and website interaction. These tools operate with elevated privileges, accessing functionalities beyond standard webpages. This convenience, however, introduces security risks, as demonstrated by researcher Gal Weizman. His findings highlight how malicious browser extensions can exploit these AI capabilities, potentially turning them against users.
2BragJack Research
Gal Weizman's BragJack research targeted AI assistants in Chrome, Edge, Opera, and Perplexity Comet. The attacks exploited vulnerabilities in Chromium's declarativeNetRequest system, allowing extensions to manipulate network requests. This enabled unauthorized access to local files, screenshots, and browser profiles. The research resulted in over $20,000 in bug bounties and two CVEs, underscoring the severity of the vulnerabilities.
3Gemini Side Panel Exploit
In Chrome, Weizman demonstrated how a malicious extension could manipulate Gemini's side panel. Despite Chrome's safeguards against script injection, the extension exploited network request manipulation to access privileged browser capabilities. This included capturing screenshots and activating the camera and microphone without user interaction. Google patched the vulnerability, awarding a $7,000 bounty for the discovery.
4Perplexity Comet Risks
Perplexity Comet's AI agent, capable of website actions, was also vulnerable. Weizman found that Comet trusted certain Perplexity domains lacking extension protections. By removing redirects, the extension could communicate with Comet's agent, accessing browsing history and local files. The agent could then summarize emails and send them to another address, showcasing the potential for data exfiltration.
5Edge's Race Condition
Microsoft Edge's AI agent had safeguards to prevent unauthorized actions, but Weizman discovered a timing flaw. A race condition allowed the extension to feed prompts and enable actions before Edge completed its security checks. This enabled the AI agent to execute unauthorized commands. Microsoft classified the flaw as medium severity and patched it in Edge version 150.0.4078.48.
6Claude Extension Vulnerability
Claude in Chrome, being a browser extension itself, was also exploited. A page on Claude's domain could send prompts to its side panel, which another extension could manipulate. This allowed forced prompts into Claude, demonstrating the risks of AI extensions interacting with trusted pages. Anthropic awarded a bounty for this finding, classifying it as medium severity.
7Opera Neon Exploit
Opera Neon's AI agent was similarly vulnerable. The proof-of-concept extension could force the agent to execute website instructions. All five demonstrations were Chromium-based, allowing Weizman to reuse the same attack approach. This highlights the broader security implications for Chromium-based browsers integrating AI capabilities.
8Prompt Forcing Technique
Weizman introduced Prompt Forcing, where attackers bypass hiding malicious instructions in webpages. Instead, they force prompts through trusted channels, turning plain-English instructions into browser actions. This creates a challenge for security software, as AI agents performing actions can appear as normal browser activity, making detection difficult.
9Extension Cleanup Advice
To mitigate risks, users should regularly review and remove unused browser extensions. Disabling or removing extensions reduces the attack surface, especially for AI agents with elevated privileges. Browsers like Chrome, Edge, and Opera provide tools to manage extensions, and users should prioritize updating browsers to apply security patches promptly.
10Broader Security Implications
The BragJack research underscores the evolving security landscape as AI agents gain deeper browser access. While the attacks were proof-of-concept, they highlight potential real-world exploits. Companies must strengthen barriers between extensions and privileged AI systems, ensuring that AI capabilities cannot be easily hijacked by malicious actors.