# How a Single Browser Extension Could Hijack AI Assistants Across Major Browsers
A recent investigation has revealed that a malicious browser extension could potentially seize control of the AI assistants embedded inside five popular Chromium-based products. The affected platforms include Gemini Live in Google Chrome, Perplexity’s Comet, Microsoft Edge, Opera Neon, and the Claude integration within Chrome.
The discovery highlights a serious gap in how browser-based artificial intelligence agents interact with the extensions that users commonly install. Once a compromised extension gains a foothold, it can communicate with the browser’s built-in AI system through a method that exploits the trust relationship between a webpage and the AI agent running inside it.
## How the Attack Works
Modern AI-powered browsers give their AI agents a dual nature: a “body” that operates locally and can see the screen, access files, use the camera and microphone, and perform actions; and a “brain” that runs on remote servers and instructs the body on what to do. The body only accepts commands from one specific trusted webpage — for example, gemini.google.com for Google’s Gemini or perplexity.ai for Perplexity’s Comet.
The vulnerability lies in the fact that a browser extension, even though it is not supposed to control the browser itself, can manipulate web pages. Researchers found that by using two common permissions — one that modifies web pages (the same permission ad blockers rely on) and another called declarativeNetRequest that manages network traffic — the extension could inject its own code into the trusted page and impersonate the legitimate vendor.
This single trick allowed the extension to speak directly to the AI agent and issue commands as if it were the trusted page the agent was designed to listen to.
## What Each Product Exposed
The impact varied significantly from one product to the next, depending on how much access the AI agent had and how strictly the browser vendor had restricted extensions.
– **Google Chrome** allowed the extension to read local files, access the camera and microphone, take screenshots, and leak the browser profile — all without requiring any mouse clicks from the user. This vulnerability, first identified earlier in the year, was patched in Chrome version 143.0.7499.192 and assigned CVE-2026-0628.
– **Perplexity Comet** proved to be the most exposed platform. Because Comet was built as a fully AI-driven browser, the hijacked agent could read any file on the computer, capture browsing history, take screenshots, and act on behalf of the user — all through the same extension injection technique. The attack was carried out through a test subdomain that had not been locked down with the same restrictions as the main site.
– **Microsoft Edge** allowed the extension to take control of the AI agent, but was the hardest platform to compromise. The research team combined two separate weaknesses: first, they took over a Microsoft marketing page that was permitted to send prompts to Edge’s AI, and then they exploited a timing flaw known as a race condition to switch the agent between its thinking and acting modes at the precise moment needed to execute a malicious prompt. Microsoft assigned CVE-2026-55945 and patched the issue in Edge version 150.0.4078.48.
– **Opera Neon** was the easiest platform to exploit. Its AI agent communicated directly through opera.com, and Opera had not prevented extensions from running code on that page, leaving the door open for direct command injection.
– **Claude in Chrome** was the least severe case. Since Claude operates as a browser extension rather than a fully integrated browser AI, the attack was essentially one extension abusing another, rather than an extension exploiting the browser itself. The finding was classified as medium severity and a bounty was paid.
## Financial Impact and Disclosure
The research team reportedly earned approximately $20,000 in bug bounties across the five products, though the individual bounty amounts listed in each case total $20,500. The Chrome finding carried the highest bounty at $7,000, while the Claude in Chrome finding earned the lowest at $600.
None of the five vulnerabilities appeared in the U.S. Known Exploited Vulnerabilities catalog as of mid-September 2026, and no public evidence confirmed that any of these methods had been used in a real-world attack. All attack scenarios require the victim to have already installed the malicious extension — the same entry point as many other browser-based threats.
## Common Patterns Across All Five Platforms
The core lesson from this research is clear: embedding an AI agent directly into the browser creates a new attack surface that traditional browser security models were not designed to address. Extensions that operate with low-level privileges can find indirect paths to reach high-privilege components of the browser, bypassing the safeguards that were originally built to keep them separate.
Other researchers have reported similar weaknesses in AI-driven browsers over the past year, suggesting that this class of vulnerability is a growing concern across the industry.
## Recommended Actions for Users
For the two platforms that have received official patches, users should update immediately:
– **Chrome:** Update to version 143.0.7499.192 or later.
– **Edge:** Update to version 150.0.4078.48 or later.
For the three platforms where patches have not yet been publicly documented, users are advised to keep their software updated and carefully review the browser extensions they have installed.
## FAQ
**Q: Has this vulnerability been exploited in the wild?**
A: No. As of the time of the investigation, no public evidence indicated that any of the five methods described had been used in a real-world attack. All findings were the result of researcher demonstrations, not observed malicious activity.
**Q: What do I need to do to protect myself?**
A: The most important step is to keep your browser updated to the latest version. Additionally, review and audit the browser extensions you have installed, removing any that are unnecessary or from unverified sources. Since the attack requires the user to install a malicious extension first, being selective about what you add to your browser is a strong line of defense.
**Q: Why was Google Chrome one of the most affected platforms?**
A: Chrome’s AI assistant, Gemini Live, had broad local access that included reading files, using the camera and microphone, and taking screenshots — all without requiring any user interaction beyond installing the malicious extension. This made it particularly high-impact compared to other platforms.
**Q: What makes Perplexity Comet the most vulnerable of the five?**
A: Perplexity designed Comet as a fully AI-driven browser, meaning the AI agent had extensive permissions to interact with the system. Once the extension hijacked the trusted page, the agent could read any file, view browsing history, take screenshots, and act as the user — giving the attacker near-complete control.
**Q: Has Microsoft fixed the vulnerability in Edge?**
A: Yes. Microsoft patched the issue in Edge version 150.0.4078.48, which was released on July 2. The vulnerability was assigned CVE-2026-55945 and rated 4.2 in severity.
**Q: Why did the Claude in Chrome finding receive the lowest severity rating?**
A: Claude in Chrome is implemented as a browser extension rather than a fully integrated browser AI. The vulnerability involved one extension manipulating another, which is a less severe attack path than an extension exploiting the browser’s core AI infrastructure. Anthropic rated it medium severity and a bounty was issued.
**Q: What is being done to prevent similar issues in the future?**
A: The research community has raised awareness that AI agents embedded in browsers introduce new security challenges that existing extension permission models were not built to address. Browser vendors are actively working on tightening the boundary between extensions and AI components, though the pace of fixes varies across platforms.
## Conclusion
The investigation into browser-based AI assistants reveals a troubling reality: the rapid integration of AI agents into everyday browsing tools has opened new doors that security models have not yet fully closed. While patches for the most critical cases have been deployed, three of the five affected platforms still lack public documentation of a fix for the specific method described.
This research serves as an important wake-up call — not just for browser developers, but for users as well. The line between a helpful browser extension and a malicious one can be blurred, and as AI agents gain more access to our systems, the stakes of that blurring grow higher. Staying vigilant about extension permissions, keeping software current, and understanding that AI tools carry new risks are all essential steps in staying safe.
The cybersecurity community will continue to monitor how browser vendors respond to these challenges and whether the industry adopts more robust safeguards for AI-powered browsing experiences.
Thank you for reading
