One Extension Could Hijack AI Assistants Across Chrome, Comet, Edge, Opera Neon and Claude

Summary

Security researchers at Forever Security discovered that a single malicious browser extension could compromise AI assistants across five Chromium-based products by exploiting two common permissions (web page modification and network traffic interception) to inject code into trusted pages. The vulnerability, initially found in Chrome as GlicJack (CVE-2026-0628, CVSS 8.8) and patched in January 2026, was replicated against Comet, Edge, Opera Neon, and Claude in Chrome, with only Edge receiving a CVE (CVE-2026-55945, CVSS 4.2). Depending on the product, the hijacked AI could read local files, access camera/microphone, leak browsing history, take screenshots, and act on behalf of the user.

Full text

One Extension Could Hijack AI Assistants Across Chrome, Comet, Edge, Opera Neon and Claude Swati KhandelwalSep 16, 2026Vulnerability / Browser Security Security researchers at Forever Security have shown that one ordinary browser extension could take control of the AI assistants built into five Chromium-based products: Gemini Live in Chrome, Perplexity Comet, Microsoft Edge, Opera Neon and the Claude in Chrome extension. Once the extension was installed, it could access each product's built-in AI with a single click. On Comet, Edge, Opera Neon, and Claude in Chrome, it could drive the AI agent to act on behalf of the attacker; on Chrome and Comet, it could read files from the user's computer, and on Chrome, it could also switch on the camera and microphone. The findings are researcher demonstrations, not attacks seen in the wild, and each requires the attacker's extension to be already running in the victim's browser. These products all work the same way. The AI has a "body" inside the browser that can see the screen, open files, use the camera, and take actions, and a "brain" that runs on the company's servers and tells the body what to do, according to Forever Security. The body only takes orders from one trusted web page, such as gemini.google.com for Chrome or perplexity.ai for Comet. An extension is not supposed to be able to command that body. It can change web pages, not control the browser itself. Forever Security's method was to seize the trusted page the body listens to and, through it, send the body its own commands. The extension needed only two common permissions, the researchers said: one that changes web pages, which ad blockers use, and one called declarativeNetRequest that changes the browser's network traffic. Together they let the extension slip its own code into the trusted page and speak to the AI as if it were the vendor. The Chrome case is not new. Forever Security researcher Gal Weizman first detailed it publicly in March as GlicJack, and Google fixed it in early January 2026 in Chrome version 143.0.7499.192. It is tracked as CVE-2026-0628 and rated 8.8 out of 10 by the U.S. cybersecurity agency CISA, which set the score because the National Institute of Standards and Technology has not. The other four are what Weizman added this year. Using the same idea, Forever Security said it reached the built-in AI in Comet, Edge, Opera Neon, and Claude in Chrome. Only the Edge finding received a CVE, CVE-2026-55945, a lower-severity issue rated 4.2 that Microsoft fixed in Edge version 150.0.4078.48 on July 2. The Comet, Opera Neon and Claude findings have no CVE and rest on Forever Security's own account. The company said it earned about $20,000 in bug bounties across the five products, though its per-product figures add up to $20,500. Forever Security listed what each attack could do. Capability Chrome Comet Edge Opera Neon Claude in Chrome Read local files Yes Yes No No No Camera and microphone Yes No No No No Control the AI agent No Yes Yes Yes Yes Leak browser profile Yes Yes No No No Leak browsing history No Yes No No No Take screenshots Yes Yes No No No No clicks needed Yes Yes Yes Yes Yes CVE CVE-2026-0628 None CVE-2026-55945 None None Bounty paid $7,000 $7,000 $5,000 $900 $600 Comet was the worst case, the researchers said. Perplexity built Comet as a fully AI-driven browser, so its agent had broad powers: once hijacked, it could read any file on the computer, list the sites the user had visited, take screenshots, and act as the user. Perplexity had blocked extensions from its main page, so Forever Security used a leftover test address, testing.perplexity.com, that was not locked down the same way. Claude in Chrome was the mildest case, and Forever Security said so directly. "Claude in Chrome is a browser extension, not a browser," the company wrote, and it called the finding the least serious in the research because one extension was abusing another rather than an extension abusing a browser. Anthropic rated it medium severity and paid a bounty. Forever Security also said Anthropic named it the first to report the Claude finding. That sits alongside earlier public reports about the same weak spot in the extension. Security firm LayerX described a related flaw, called ClaudeBleed, in April, and Manifold Security reported in July that a similar gap remained open in a later version. Edge was the hardest to break, the researchers said. Microsoft had tried to block the extension trick, so Forever Security combined two weaknesses. It took over a Microsoft marketing page that was allowed to send prompts to the Edge AI. It then used a timing flaw, called a race condition, to switch the agent between its "think" and "act" modes at the right moment, causing it to carry out a prompt. Opera Neon was the easiest. Its AI took orders from opera.com, and Opera had not stopped extensions from running code on that page so that the extension could send commands straight through. Forever Security said Opera reported finding the same flaw on its own at around the same time but paid a reward anyway. As of September 16, 2026, neither CVE was listed on the U.S. Known Exploited Vulnerabilities catalog, and no public evidence showed any of the five methods being used in a real attack. Every one of them assumes the attacker has already got the user to install the extension, the same starting point as many other browser attacks. For the two products with a CVE, the fix is to update Chrome to version 143.0.7499.192 or later and Edge to version 150.0.4078.48 or later. For Comet, Opera Neon, and Claude in Chrome, Forever Security said each vendor paid a reward but did not give a date for fixing the exact method it described. Users of those three should make sure their software is up to date and review the extensions they have installed. The common thread, Forever Security said, is that putting an AI agent inside the browser reopens a path that browsers work hard to close, allowing a low-privilege extension to reach a high-privilege part of the browser. Other researchers have reported related weaknesses in AI-driven browsers over the past year. Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. SHARE     Tweet Share Share Share SHARE  artificial intelligence, browser security, Vulnerability, Web Security ⚡ Top Stories This Week OpenAI Agents Linked to RubyGems Campaign That Gained RCE on RubyDoc Servers GitLab CVSS 10 File-Read Flaw Draws In-the-Wild Probes After Disclosure Claude Used to Automate Exploitation and Data Theft Across Multiple Victims Attackers Chain JFrog Artifactory Flaws to Gain Admin Control and Plant Backdoors PaperCut Replaces Emergency Patches With Fixes for Two Actively Exploited Flaws Cisco FMC Flaws Exploited to Steal Credentials and Deploy Qilin Ransomware ThreatsDay: 200 Android Flaws, Browser-Built Phishing, 119K Scam Shops + 23 More Stories Check Point Discloses Two 9.8-Rated VPN Certificate Flaws Enabling Unauthenticated RCE Anthropic Discloses Fourth AI Hacking Incident Involving Claude Opus 4.6 Four Spy Groups Used the Same Chrome and Windows Exploit Kit Within a Week DeepSeek Harness Flaw Let AI Agents Disable Their Own File Sandbox Without Approval Chrome V8 Zero-Day Exploited in the Wild Enables Code Execution Inside Sandbox New cPanel Flaw Lets a Hosting Account With Mail Privileges Run Code as Root F5 BIG-IP APM Malware Injects a PHP Web Shell Into Memory, Evading Disk Scans Researcher Drops New Microsoft Defender PoC Showing ShieldBreak Patch Can Be Bypassed Microsoft Patches Record 974 Flaws, Including Two Exploited Windows Zero-Days ChatGPT Flaw Let a Planted Prompt Send a Victim's Gmail Data to Another Account WeChat Zero-Click Worm Took Over Accounts on iPhone and Android via Incoming Calls Fake IT Calls Target Executives in Microsoft 365 Data Theft and Extortion Attacks When the Whole Company Adopts AI: What It Does to Your SOC Your Criti

Indicators of Compromise

• cve — CVE-2026-0628
• cve — CVE-2026-55945
• domain — testing.perplexity.com

Entities