Single Extension Can Hijack AI Assistants in Five Browsers

Security researchers have demonstrated that a single, seemingly harmless browser extension can take control of the artificial intelligence assistants embedded in five major browsers. The finding, reported by The Hacker News, shows that tools like Chrome's Gemini and Perplexity's Comet can be coerced into reading local files, accessing cameras, and acting on an attacker's behalf.

The vulnerability does not require complex malware or remote code execution. Instead, it exploits the way these AI agents are designed to trust specific web pages. By manipulating the network traffic and content of these trusted pages, a standard extension can issue commands directly to the AI, effectively bypassing the security boundaries that separate browser extensions from the browser's core functions.

Common Permissions Enable the Attack

The method relies on two permissions that are frequently granted to popular add-ons like ad blockers. One allows the extension to modify web page content, while the other, known as declarativeNetRequest, permits changes to network requests. Together, these capabilities allow the extension to inject its own code into the specific interface the AI uses to receive instructions.

This creates a significant trade-off for users. While these permissions are necessary for many useful extensions to function, they also provide a pathway for malicious software to impersonate the browser vendor. The AI agent, designed to follow orders only from its official interface, cannot distinguish between a legitimate command and one injected by a rogue extension.

Varied Risks Across Browsers

The severity of the breach varies depending on the specific browser implementation. In Chrome and Perplexity Comet, the compromised AI could access local files and, in the case of Chrome, activate the camera and microphone. Comet was identified as the most vulnerable, as its agent had broad permissions to list browsing history and take screenshots of the screen.

In contrast, the issue in Microsoft Edge and Opera Neon was primarily limited to controlling the AI agent's actions, such as navigating websites or interacting with forms. The Claude in Chrome extension was deemed the least serious case, as the attack involved one extension abusing another rather than compromising the browser's core environment directly.

Patches and Unresolved Gaps

Google has already patched the specific flaw in Chrome, rating it a high-severity issue. Microsoft also issued a fix for Edge, though it was classified as lower severity. However, the vulnerabilities in Comet, Opera Neon, and the Claude extension have not yet received official Common Vulnerabilities and Exposures identifiers.

This leaves a gap in the security landscape for several major products. Until vendors address these specific implementation details, users remain exposed to the risk that a trusted extension could be used as a bridge to control powerful AI agents. The incident highlights the growing complexity of securing AI-integrated software, where the boundary between user tools and system-level AI actions is increasingly blurred.