Table of Contents

Introduction

Security researchers at Forever Security have shown that one ordinary browser extension could take control of the AI assistants built into five Chromium-based products: Gemini Live in Chrome, Perplexity Comet, Microsoft Edge, Opera Neon and the Claude in Chrome extension.

Once the extension was installed, it could access each product's built-in AI with a single click. On Comet, Edge, Opera Neon, and Claude in Chrome, it could drive the AI agent to act on behalf of the attacker; on Chrome and Comet, it could read files from the user's computer; and on Chrome, it could also switch on the camera and microphone.

These findings are researcher demonstrations, not attacks seen in the wild. Each requires the attacker's extension to be already running in the victim's browser.

This blog is based on reporting by Swati Khandelwal (September 16, 2026).

What Researchers Found

The research demonstrates a common architectural weakness across five Chromium-based AI products. The core problem: AI agents embedded in browsers create a new bridge between low-privilege extensions and high-privilege browser capabilities.

According to Forever Security, the findings were responsibly disclosed, and the company earned approximately $20,000 in bug bounties across the five products (though its per-product figures add up to $20,500).

"The common thread is that putting an AI agent inside the browser reopens a path that browsers work hard to close, allowing a low-privilege extension to reach a high-privilege part of the browser."

— Forever Security

How the Attack Works: Body and Brain

These products all work the same way, according to Forever Security:

An extension is not supposed to be able to command that body. It can change web pages, not control the browser itself.

Forever Security's method was to seize the trusted page the body listens to and, through it, send the body its own commands.

The attack exploits the trust boundary between the extension and the AI agent's command channel — the extension effectively impersonates the vendor's own trusted page.

Only Two Common Permissions Needed

The extension needed only two common permissions, the researchers said:

Together, they let the extension slip its own code into the trusted page and speak to the AI as if it were the vendor.

Neither permission is inherently malicious — both are used by legitimate extensions every day. That's what makes this attack pattern so concerning.

Chrome: The GlicJack Precedent (CVE-2026-0628)

The Chrome case is not new. Forever Security researcher Gal Weizman first detailed it publicly in March as GlicJack, and Google fixed it in early January 2026 in Chrome version 143.0.7499.192.

It is tracked as CVE-2026-0628 and rated 8.8 out of 10 by the U.S. cybersecurity agency CISA, which set the score because the National Institute of Standards and Technology has not.

Chrome users should update to version 143.0.7499.192 or later to be protected against this specific attack.

Edge: The Only Other CVE (CVE-2026-55945)

Only the Edge finding received a CVE — CVE-2026-55945, a lower-severity issue rated 4.2 that Microsoft fixed in Edge version 150.0.4078.48 on July 2.

Edge was the hardest to break, the researchers said. Microsoft had tried to block the extension trick, so Forever Security combined two weaknesses:

Edge users should update to version 150.0.4078.48 or later to be protected against this specific attack.

Comet: The Worst Case

Comet was the worst case, the researchers said. Perplexity built Comet as a fully AI-driven browser, so its agent had broad powers: once hijacked, it could:

Perplexity had blocked extensions from its main page, so Forever Security used a leftover test address, testing.perplexity.com, that was not locked down the same way.

Comet has no CVE for this finding. Forever Security said Perplexity paid a reward but did not give a date for fixing the exact method described.

Opera Neon: The Easiest Target

Opera Neon was the easiest. Its AI took orders from opera.com, and Opera had not stopped extensions from running code on that page, so the extension could send commands straight through.

Forever Security said Opera reported finding the same flaw on its own at around the same time but paid a reward anyway.

Opera Neon has no CVE for this finding. Users should ensure their software is up to date and review installed extensions.

Claude in Chrome: The Mildest Case

Claude in Chrome was the mildest case, and Forever Security said so directly.

"Claude in Chrome is a browser extension, not a browser."

— Forever Security

The company called the finding the least serious in the research because one extension was abusing another rather than an extension abusing a browser. Anthropic rated it medium severity and paid a bounty.

Forever Security also said Anthropic named it the first to report the Claude finding. That sits alongside earlier public reports about the same weak spot in the extension:

Claude in Chrome has no CVE for this finding. Anthropic paid a bounty but did not give a date for fixing the exact method described.

Capability Comparison Across All Five Products

Forever Security listed what each attack could do:

Capability Chrome Comet Edge Opera Neon Claude in Chrome
Read local files Yes Yes No No No
Camera and microphone Yes No No No No
Control the AI agent No Yes Yes Yes Yes
Leak browser profile Yes Yes No No No
Leak browsing history No Yes No No No
Take screenshots Yes Yes No No No
No clicks needed Yes Yes Yes Yes Yes
CVE CVE-2026-0628 None CVE-2026-55945 None None
Bounty paid $7,000 $7,000 $5,000 $900 $600

Note the pattern: Chrome had the broadest raw capabilities (files, camera, mic), but Comet and Edge had the most dangerous agent control — the ability to act as the user.

Bug Bounties: What Vendors Paid

Forever Security said it earned about $20,000 in bug bounties across the five products, though its per-product figures add up to $20,500:

All five vendors acknowledged the findings and paid rewards. Two (Google and Microsoft) issued CVEs and shipped fixes. Three (Perplexity, Opera, Anthropic) paid but did not publish a fix date for the exact method described.

Not Yet Exploited in the Wild

As of September 16, 2026:

The fact that these are researcher demonstrations doesn't make them less important. They reveal a structural weakness in how AI agents are integrated into browsers — one that will likely be targeted once it becomes more widely known.

What Businesses Should Do

If your organization uses any of these browsers or AI assistants, here's a practical checklist:

If your organization is deploying AI-enabled browsers, consider working with a managed security partner to establish extension policies and monitor for emerging threats.

Final Thoughts

The Forever Security research reveals a structural risk that comes with putting AI agents inside browsers: the same architecture that makes them useful — a "body" that can see and act, a "brain" that commands it — also creates a new path for low-privilege extensions to reach high-privilege capabilities.

Key takeaways:

If your organization needs help securing AI-enabled browsers, auditing extensions, or building a browser security policy, contact SystemLogicIT for expert guidance across the United States and United Kingdom.

SL
SystemLogicIT Team
Browser Security & Cyber Threat Protection Experts
Helping US and UK organizations secure browsers, extensions, and AI-powered tools against emerging threats.

Related Articles

Anthropic: Claude Used to Automate Exploitation, Data Theft & Mass Surveillance

September 12, 2026

AI-Powered Hacking Tool Can Breach Phones Without a Click — The WeWorm Attack

September 10, 2026

ChatGPT Flaw Let a Planted Prompt Send a Victim's Gmail Data to Another Account

September 9, 2026