Single Browser Extension Can Hijack Multiple AI Assistants
Researchers demonstrated a single browser extension can hijack AI assistants in Chrome, Comet, Edge, and Opera Neon, gaining control over their functionalities.
Security researchers at Forever Security have uncovered a critical vulnerability allowing a single browser extension to hijack AI assistants integrated into popular Chromium-based products. The affected platforms include Gemini Live in Chrome, Perplexity Comet, Microsoft Edge, Opera Neon, and the Claude in Chrome extension. This alarming discovery means an attacker could potentially gain control over these AI functionalities with minimal user interaction, posing a significant risk to user data and privacy.
Once installed, the malicious extension could access each product's built-in AI with a single click. The researchers demonstrated that on Comet, Edge, Opera Neon, and Claude in Chrome, the extension could command the AI agent to act on behalf of the attacker. In more severe cases, on Chrome and Comet, the extension could read local files from the user's computer, and on Chrome specifically, it could even activate the device's camera and microphone.
These findings, while currently demonstrations and not observed in the wild, highlight a severe potential for exploitation. The core of the attack lies in how these AI assistants are designed. They typically consist of a "body" within the browser capable of interacting with the user's system (viewing the screen, accessing files, using peripherals) and a "brain" on the vendor's servers that dictates actions. The "body" is designed to only accept commands from a single, trusted web page associated with the AI service.
The vulnerability exploited by Forever Security involves subverting this trust mechanism. Browser extensions are generally limited to modifying web pages, not controlling the browser's core functions. However, by compromising the trusted page that the AI "body" listens to, the extension can effectively inject its own code and send commands to the AI as if it were the legitimate vendor. This is achieved using two common browser extension permissions: one for changing web pages and another, declarativeNetRequest, for modifying network traffic.
This attack vector is not entirely new for Chrome. Researcher Gal Weizman had previously detailed a similar flaw, dubbed GlicJack, which Google patched in January 2026 (CVE-2026-0628). However, Forever Security's latest research extends this technique to four other platforms. While Microsoft addressed a related issue in Edge (CVE-2026-55945), findings for Comet, Opera Neon, and Claude in Chrome currently lack CVE assignments, though vendors have reportedly paid bug bounties.
The impact varies across the affected products. Perplexity's Comet browser, designed as a fully AI-driven experience, proved to be the most vulnerable. Hijacking its AI agent allowed it to read any file, list visited sites, take screenshots, and act as the user. This was possible due to an overlooked test address (testing.perplexity.com) that lacked the same security restrictions as Comet's main page. The Claude in Chrome extension presented the mildest case, as it involved one extension abusing another rather than directly compromising a browser.
Microsoft's Edge required a more complex exploit, combining two weaknesses to bypass security measures designed to prevent such extension-based attacks. Opera Neon was found to be the easiest to compromise, as its AI accepted commands directly from the opera.com page without sufficient extension restrictions. As of mid-September 2026, neither of the assigned CVEs were listed on the CISA Known Exploited Vulnerabilities catalog, and no real-world attacks have been publicly reported, though all exploits require the victim to have already installed the malicious extension.
For users of Chrome and Edge, updating to the latest versions (Chrome 143.0.7499.192+ and Edge 150.0.4078.48+) is crucial. While vendors for Comet, Opera Neon, and Claude in Chrome have reportedly issued fixes and paid bug bounties, specific update instructions or CVEs for these platforms are not yet widely available, underscoring the need for vigilance when installing browser extensions.
The BragJack attack, discovered by Gal Weizman of Forever Security, expands upon the concept of a single browser extension hijacking multiple AI assistants. While the previous story focused on the general capability, BragJack specifically details how this is achieved by exploiting a critical design flaw in how agentic browsers interact with extensions, allowing attackers to hijack the communication channel and force prompts into the browser's built-in agent. This novel technique bypasses traditional prompt injection methods and has been demonstrated against Google Chrome with Gemini, Microsoft Edge, Opera Neon, Perplexity Comet, and Claude in Chrome, with researchers earning over $20,000 in bug bounties and specific CVEs being issued for Google and Microsoft's implementations (CVE-2026-0628 and CVE-2026-55945).