Extension Could Hijack Built-in AI Assistants

Estimated reading time: 5 minutes · Last updated: 17 September 2026

Security researcher group Forever Security demonstrated that a single browser extension can hijack the built-in AI assistants in five Chromium-based products: Gemini Live in Chrome, Perplexity Comet, Microsoft Edge, Opera Neon and the Claude-in-Chrome extension. The method seizes a browser page the AI’s in‑browser “body” trusts and, using two common extension permissions, injects code so the extension speaks to the AI as if it were the vendor. Chrome and Edge have documented fixes: Chrome’s issue is tracked as CVE-2026-0628 and was fixed in Chrome 143.0.7499.192; Edge received CVE-2026-55945 and a July 2 fix in Edge 150.0.4078.48.

Claude in Chrome is a browser extension, not a browser

Forever Security

How one extension seizes an AI assistant inside the browser

Forever Security says these AI assistants split into a server-side “brain” and an in‑browser “body.” The body runs inside a browser page and is allowed to see the screen, open files, use camera and microphone, and take actions; it accepts commands only from one trusted web page such as gemini.google.com or perplexity.ai. The researchers’ technique does not elevate an extension’s core privileges; instead it compromises the single trusted page the body listens to and makes that page send attacker-controlled prompts to the body.

To do this the extension needs two permissions the researchers describe as common: one permission that can change web pages (the kind ad blockers use) and the declarativeNetRequest permission that modifies browser network traffic. Forever Security’s proof-of-concept uses these permissions to slip its own code into the trusted page so the extension can speak to the AI as if it were the vendor.

The March demonstration of the same idea against Chrome was publicised as GlicJack by researcher Gal Weizman and is tracked as CVE-2026-0628; Forever Security expanded the approach this year to show similar outcomes in Comet, Edge, Opera Neon and Claude in Chrome.

What each vendor exposed and how serious it was

Forever Security tabulated capabilities per product. Chrome could read local files, switch on camera and microphone, leak the browser profile and take screenshots; Comet could read local files, leak browsing history, take screenshots and fully act as the user; Edge, Opera Neon and Claude in Chrome varied in which capabilities the researchers reached. The researchers described Comet as the worst case because Perplexity built Comet as a fully AI-driven browser and Forever Security reached a leftover test address, testing.perplexity.com, that Comet had not locked down.

Two of the five findings received CVEs. Chrome’s issue is CVE-2026-0628 and was given an 8.8 severity score by the U.S. Cybersecurity and Infrastructure Security Agency (CISA); Forever Security says Google fixed it in Chrome 143.0.7499.192 in early January 2026. Edge’s issue is CVE-2026-55945, rated 4.2, and Microsoft fixed it in Edge 150.0.4078.48 on July 2. The Comet, Opera Neon and Claude findings have no CVE listed and rest on Forever Security’s account; those vendors paid bounties but Forever Security did not give public patch dates for the exact methods described.

Forever Security reported total bounties of about $20,000 across the five products and published per-product amounts that add up to $20,500: Chrome $7,000, Comet $7,000, Edge $5,000, Opera Neon $900 and Claude in Chrome $600.

Practical controls the research pointed to and limits of the attack

The researchers emphasise two practical limits. Every demonstration assumes the attacker has already persuaded a user to install the malicious extension; the technique then uses that extension’s normal permissions to impersonate the trusted page. Forever Security also notes no public evidence exists of these specific methods being exploited in the wild and that, as of September 16, 2026, neither CVE was in the U.S. Known Exploited Vulnerabilities catalog.

For the two products with documented fixes, the remedy is to update: Chrome to 143.0.7499.192 or later and Edge to 150.0.4078.48 or later. For Comet, Opera Neon and Claude in Chrome, Forever Security’s advice is the same basic guidance it gives users elsewhere: make sure software is up to date and review the extensions you have installed. That phrasing — to “review the extensions they have installed” — is the practical action the researchers recommend for users of the three products without a named patch date.

The underlying architectural lesson the researchers draw is that placing an AI agent inside the browser reopens a path browsers normally close: a low‑privilege extension can reach a higher‑privilege in‑browser component when vendors allow a single trusted page to command the agent.

How the situation could change

The bottom line

Forever Security’s demonstrations underline a recurring architectural risk: granting an in‑browser agent broad capabilities while tying it to a single trusted page creates a channel that common extension permissions can exploit. Chrome and Edge have published fixes tied to CVE-2026-0628 and CVE-2026-55945 respectively, but Comet, Opera Neon and Claude in Chrome remain dependent on vendor patching timelines. Organisations and users should prioritise the fixed Chrome and Edge releases and, for other products, confirm vendor mitigations and audit installed extensions until explicit patches are available.

What to watch

• Watch for vendor patch announcements from Perplexity, Opera and Anthropic; no date has been set.
• Watch for changes to Chromium extension permission models that affect declarativeNetRequest and page‑modification; no date has been set.