Forever Security shows browser extension can hijack AI assistants in five Chromium products

September 16, 2026 at 07:36 PM2 min

This digest was compiled by AI from multiple sources — links to the originals are below.

Security researchers at Forever Security demonstrated that a single browser extension could take control of AI assistants in five Chromium-based products: Gemini Live in Chrome, Perplexity Comet, Microsoft Edge, Opera Neon, and Claude in Chrome. The extension could drive the AI agents to act on behalf of an attacker, read files, and switch on the camera and microphone. The findings are researcher demonstrations, not attacks seen in the wild, and require the attacker's extension to be already running in the victim's browser.

Key Facts

Forever Security demonstrated that one browser extension could control AI assistants in five Chromium-based products: Gemini Live in Chrome, Perplexity Comet, Microsoft Edge, Opera Neon, and Claude in Chrome.
On Comet, Edge, Opera Neon, and Claude in Chrome, the extension could drive the AI agent to act on behalf of the attacker; on Chrome and Comet, it could read files from the user's computer; and on Chrome, it could switch on the camera and microphone.
The Chrome vulnerability is tracked as CVE-2026-0628, rated 8.8 out of 10 by CISA, and was fixed in Chrome version 143.0.7499.192 in early January 2026.
Microsoft fixed the Edge vulnerability, CVE-2026-55945 rated 4.2, in Edge version 150.0.4078.48 on July 2.
Forever Security said it earned about $20,000 in bug bounties across the five products, though its per-product figures add up to $20,500.

Attack Method

The AI assistants in these products have a 'body' inside the browser that can see the screen, open files, use the camera, and take actions, and a 'brain' that runs on the company's servers and tells the body what to do, according to Forever Security. The body only takes orders from one trusted web page, such as gemini.google.com for Chrome or perplexity.ai for Comet. Forever Security's method was to seize the trusted page the body listens to and, through it, send the body its own commands. The extension needed only two common permissions: one that changes web pages, which ad blockers use, and one called declarativeNetRequest that changes the browser's network traffic. Together they let the extension slip its own code into the trusted page and speak to the AI as if it were the vendor.

Vulnerability Details

Forever Security researcher Gal Weizman first detailed the Chrome case publicly in March as GlicJack, and Google fixed it in early January 2026 in Chrome version 143.0.7499.192. It is tracked as CVE-2026-0628 and rated 8.8 out of 10 by the U.S. cybersecurity agency CISA, which set the score because the National Institute of Standards and Technology has not. Using the same idea, Forever Security said it reached the built-in AI in Comet, Edge, Opera Neon, and Claude in Chrome. Only the Edge finding received a CVE, CVE-2026-55945, a lower-severity issue rated 4.2 that Microsoft fixed in Edge version 150.0.4078.48 on July 2. The Comet, Opera Neon and Claude findings have no CVE and rest on Forever Security's own account.