CybersecurityHacking

Browser Extensions Expose AI Assistants to Takeover Risk

Analyst 207||Source: TheHackerNews
Laptop screen displays browser extension permission settings in a bright, empty workspace.
"Claude in Chrome is a browser extension, not a browser." — Forever Security

How the attack works: the "body" inside the browser and the "brain" on the server

Forever Security's researchers described a consistent architecture behind five AI-enabled products that made them vulnerable to the same trick. Each product splits its assistant into a "body" that lives in the user's browser — able to see the screen, open files, use the camera, and take actions — and a "brain" that runs on the vendor's servers and instructs that body. The body is intended to accept commands only from one trusted web page (for example, gemini.google.com for Chrome or perplexity.ai for Comet).

Forever Security showed that an ordinary browser extension, granted two commonplace permissions, could hijack that trusted page and then speak to the body as if it were the legitimate vendor. One permission lets an extension change web pages (the same capability ad blockers typically use); the other is declarativeNetRequest, which alters browser network traffic. Together, the researchers said, those permissions allowed the extension to slip code into the trusted page and send commands to the assistant's body.

Product-by-product impact: Chrome, Comet, Edge, Opera Neon and Claude in Chrome

The researchers reported differences in what each product exposed once the trusted page was seized.

  • Chrome (Gemini Live): Forever Security previously disclosed this technique as "GlicJack" in March. Google fixed the issue in early January 2026 with Chrome version 143.0.7499.192. The demonstration showed the attack could read files from the user's computer and, on Chrome, could also enable the camera and microphone.
  • Perplexity Comet: Forever Security called Comet "the worst case." Comet is a fully AI-driven browser whose agent, once hijacked, could read any file on the computer, list sites the user had visited, take screenshots, and act as the user. Perplexity had blocked extensions on its main page, but Forever Security used a leftover test address, testing.perplexity.com, that was not protected in the same way.
  • Microsoft Edge: The researchers said Edge was the hardest to break. They described taking control of a Microsoft marketing page that was allowed to send prompts to Edge AI and exploiting a timing flaw — a race condition — to flip the agent between "think" and "act" modes so it would carry out attacker prompts. Microsoft issued a fix in Edge version 150.0.4078.48 on July 2 and the issue received CVE-2026-55945, rated 4.2.
  • Opera Neon: Forever Security said Opera Neon was the easiest to exploit because its AI took orders from opera.com and Opera had not blocked extensions from running code on that page. Opera reported finding the same flaw independently and paid a reward.
  • Claude in Chrome (Anthropic): Forever Security described this as the mildest case, calling it "the least serious" because it involved one extension abusing another rather than an extension abusing the browser itself. Anthropic rated the finding medium severity and paid a bounty; Forever Security also said it was the first to report the Claude finding.

Vulnerabilities, CVEs, and fixes: CVE-2026-0628 and CVE-2026-55945

The Chrome case is tracked as CVE-2026-0628 and was scored 8.8 out of 10 by the U.S. cybersecurity agency CISA; CISA set that score because the National Institute of Standards and Technology had not. Google resolved that issue in Chrome 143.0.7499.192. Edge's CVE-2026-55945 carried a lower severity score of 4.2 and Microsoft fixed it in Edge 150.0.4078.48 on July 2.

By September 16, 2026, neither CVE was listed on the U.S. Known Exploited Vulnerabilities catalog, and there was no public evidence any of the five methods had been used in live attacks. Forever Security stressed that each demonstration assumed the attacker's extension was already installed in the victim's browser.

Bug bounties and disclosure: payments, reporting history, and prior research

Forever Security said it earned about $20,000 in bug bounties across the five products, though the company's per-product figures sum to $20,500. For Comet, Opera Neon, and Claude in Chrome, Forever Security said each vendor paid a reward but did not provide dates for fixing the exact method the researchers described.

The record includes related public work: LayerX described a related flaw, "ClaudeBleed," in April, and Manifold Security reported in July that a similar gap remained open in a later version. Forever Security's Chrome finding was first detailed publicly in March, and other researchers had reported related weaknesses in AI-driven browsers over the past year.

What this means for technologists, CISA/NIST policymakers, and end users

  • Technologists and security teams: The common technical lesson is concrete: embedding an AI agent's body inside the browser reopens an attack surface that browsers normally try to isolate. Teams should apply vendor fixes where available (Chrome 143.0.7499.192 or later; Edge 150.0.4078.48 or later) and review installed extensions and their permissions.
  • CISA, NIST and regulators: CISA has already assigned a score to the Chrome issue because NIST had not; the public record shows patching and disclosure moving at different speeds among vendors and researchers, and neither CVE appeared on the Known Exploited Vulnerabilities catalog as of September 16, 2026.
  • End users and enterprises: Every demonstration assumed the user had already installed the malicious extension. Users should keep browsers up to date and audit extensions, while enterprises should treat extension installations and permissions as a control focus.

Forever Security summed the strategic takeaway plainly: putting an AI agent inside the browser can restore a path that browsers work to close, allowing a low-privilege extension to reach a high-privilege part of the browser. The practical near-term steps are already visible in the record — patches for Chrome and Edge, bug bounties paid, and vendor statements — but the demonstrations underscore how adding AI features to familiar software can also revive old attack patterns in new forms.

Read the original Hacker News story

Artificial IntelligenceEmerging ThreatsSupply ChainThreat ActorsVulnerabilityZero-DayMfa BypassBrowser ExtensionAI AssistantsTakeover Risk
Related Intelligence

Continue Reading

Server room with identity management console and authentication system equipment.

Public Sector Braces for Identity-Based Attacks

In today's digital landscape, your identity is the key that unlocks access to all your applications and services - making it the new perimeter that public sector organizations must fiercely protect. When identity infrastructure is compromised, attackers can gain a foothold for long-term persistence and privilege escalation, putting entire operations at risk.

Analyst 207
Mac computer on a cluttered desk with Parallels Desktop window open.

Parallels Desktop Flaw Exposes Macs to Root Access

A newly discovered flaw in Parallels Desktop, tracked as CVE-2026-90894, leaves Macs vulnerable to root access, allowing ordinary local accounts to run code as root. This security gap, dubbed ParaShells, was uncovered by JFrog's vulnerability team and rated 7.8 out of 10 in severity.

Analyst 207
Dimly lit, empty office space with broken computer and scattered furniture, late at night.

Ransomware Costs Exceed Ransom Payments

The real cost of ransomware goes far beyond the initial payment, with average incidents costing a whopping $5.08 million - a number that dwarfs the median ransom payment of $139,875. Downtime is a major culprit, with organizations often underestimating the hours and days of lost productivity that add up to a hefty bill.

Analyst 207
Server room interior with rows of computer servers and a laptop displaying a screen in the foreground.

CISA and NIST Issue Guidance to Safeguard Cloud Identity Tokens

As cyber threats escalate, protecting cloud identity tokens has become crucial - and CISA and NIST have just released guidance to help safeguard these vulnerable targets. The new interagency report provides critical advice for federal agencies, cloud service providers, and organizations that rely on them to stay secure.

Analyst 207