One Malicious Browser Extension Could Hijack AI Assistants in Chrome, Edge, Comet and Opera Neon

Security researchers at Forever Security have demonstrated that a single ordinary browser extension could seize control of AI assistants built into five popular Chromium-based products: Gemini Live in Chrome, Perplexity Comet, Microsoft Edge, Opera Neon and the Claude in Chrome extension. Once installed, the extension could interact with each product's AI, in some cases directing the AI agent to take actions on the attacker's behalf, reading files from the victim's computer, or even switching on the camera and microphone.

The method relies on a quirk in how these AI assistants work. Each has a 'body' inside the browser that can see the screen, open files and take actions, controlled by a 'brain' running on the company's servers. This body only accepts instructions from one trusted web page, such as gemini.google.com. Using two common and seemingly harmless permissions, one used by ad blockers and one that alters network traffic, the researchers found a way to inject code into that trusted page and issue commands as if they came from the vendor itself.

The Chrome flaw, first disclosed in March and tracked as CVE-2026-0628, was rated 8.8 out of 10 in severity and fixed by Google in January 2026. A related, lower-severity flaw in Edge (CVE-2026-55945, rated 4.2) was patched by Microsoft in July. The findings are researcher demonstrations rather than attacks seen in the wild, and each requires the malicious extension to already be installed and running in the victim's browser.