One Extension Against Five AI Browsers: How to Bypass an Agent's Defenses

Specialists at Forever Security have demonstrated that a single run-of-the-mill browser extension can seize control of the built-in AI assistants in five Chromium-based products at once: Gemini Live in Chrome, Perplexity Comet, Microsoft Edge, Opera Neon and the Claude in Chrome extension. Once installed, the extension gained access to each product's AI with literally a single click — and in a number of cases without a single click at all.

As the researchers describe it, all these products are built the same way. The AI has a “body” inside the browser — it sees the screen, opens files, taps the camera and carries out actions — and a “brain” on the vendor's servers that issues commands to the “body.” The “body,” however, obeys only one trusted page, for example gemini.google.com or perplexity.ai. By design, an extension is not supposed to control this mechanism: it can alter web pages, but not the browser itself. Forever Security found a way around this — hijack that very trusted page and use it to feed the “body” its own commands.

Two common permissions were enough for this: one that alters page content (used by ad blockers) and declarativeNetRequest, which meddles with network traffic. Together they made it possible to inject code into the trusted page and communicate with the AI on the vendor's behalf.

Varying severity of consequences

The capabilities depended on the product. In Chrome and Comet the extension could read local files, and in Chrome it could also switch on the camera and microphone. In Comet, Edge, Opera Neon and Claude it controlled the agent itself, acting on the user's behalf. The researchers named Comet the worst case: Perplexity built it as a fully AI-driven browser, so a hijacked agent could read any files, list visited sites and take screenshots. The main page's defenses were bypassed through a forgotten test address, testing.perplexity.com.

The mildest was deemed to be Claude in Chrome — it is an extension, not a browser, so one extension was simply abusing another. Anthropic rated the vulnerability medium severity and paid out a reward. The hardest to crack was Edge: Microsoft had already tried to block the technique, and the researchers had to combine hijacking a marketing page with a race condition that toggled the agent between “think” and “act” modes. The easiest turned out to be Opera Neon, where the commands passed straight through opera.com.

What about fixes

Only two cases received official CVEs: CVE-2026-0628 (scored 8.8, closed in Chrome 143.0.7499.192 back in early January 2026; originally described as GlicJack) and CVE-2026-55945 in Edge (scored 4.2, fixed on July 2 in version 150.0.4078.48). The findings for Comet, Opera Neon and Claude received no identifiers. In all, across the five products Forever Security earned about $20,000 through bug bounty programs.

An important caveat: all five scenarios are research demonstrations, not real-world attacks. Each requires a malicious extension to already be running in the victim's browser — the same starting point as many other browser attacks. As of September 16, 2026, none of the vulnerabilities were listed in CISA's Known Exploited Vulnerabilities catalog.

The researchers' overall conclusion: by placing an AI agent inside the browser, developers are reopening a path that browsers spent years trying to close — from a low-privilege extension to a high-privilege part of the browser.

Source: The Hacker News