Browser Extension Flaw Can Hijack AI Assistants in Chrome and Edge

Researchers at Forever Security have demonstrated that a single browser extension could hijack AI assistants built into several Chromium-based products, including Google Chrome, Microsoft Edge, Perplexity Comet, Opera Neon, and the Claude extension for Chrome.

The vulnerability allows an extension to seize control of the “trusted page” that an AI agent uses to receive instructions. By using common permissions to modify web pages and network traffic, an attacker could inject code into that trusted page, allowing the extension to command the AI as if it were the official vendor.

Vulnerabilities in Chrome and Edge

In Google Chrome, the vulnerability—tracked as CVE-2026-0628—is rated highly by CISA. If a malicious extension is installed, it can potentially read local files, take screenshots, and activate the user’s camera or microphone. Google addressed this flaw in Chrome version 143.0.7499.192.

Microsoft Edge was also found to be susceptible (CVE-2026-55945), though the researchers described this as harder to exploit. Bypassing Microsoft’s protections required a complex method involving a race condition to switch the agent between “think” and “act” modes. Microsoft released a fix in Edge version 150.0.4078.48.

Risks to AI-Driven Browsers and Extensions

Perplexity Comet was identified as a particularly high-risk case. As Comet is an AI-driven browser, a hijacked agent could read any file on a user’s computer, list browsing history, take screenshots, and act on the user’s behalf. Researchers bypassed security by targeting a legacy test address.

The Claude in Chrome extension and Opera Neon were also found to be vulnerable to command injection. While the Claude finding was considered less severe—as it involved one extension abusing another rather than the browser itself—it still allows an attacker to drive the AI agent to act on their behalf.

Mitigation and Security Status

These findings are currently researcher demonstrations and have not been observed in real-world attacks. The core issue lies in the fact that placing an AI agent inside a browser can allow low-privilege extensions to reach high-privilege parts of the browser.

Users of Chrome and Edge should ensure their browsers are updated to the latest versions. For users of Comet, Opera Neon, and Claude in Chrome, it is recommended to review all installed extensions and keep all software up to date.