Cyber Blog

A new security investigation has revealed that a seemingly ordinary browser extension could potentially take control of artificial intelligence assistants built into several popular Chromium-based browsers and applications. Researchers demonstrated that the technique could affect AI features associated with Google Chrome, Perplexity Comet, Microsoft Edge, Opera Neon, and Anthropic’s Claude in Chrome.

The research highlights a growing security concern surrounding AI-powered browsers and browser assistants. These systems are designed to do far more than simply answer questions. Depending on the product, an AI agent may be able to interact with webpages, access files, take screenshots, operate browser functions, and perform actions on behalf of the user. If an attacker can manipulate the connection between the browser and its AI assistant, those capabilities could potentially be abused.

According to the researchers, the attack depends on a malicious or compromised browser extension already being installed and active on the victim’s computer. The demonstrations were conducted as security research and were not presented as evidence of attacks occurring in the wild. However, the findings show how an extension with relatively common browser permissions could potentially reach functionality that normally should be isolated from extensions.

The technique takes advantage of the way AI assistants are integrated into modern browsers. In simplified terms, the AI system has a remote component that determines what should happen and a browser-side component that carries out those instructions. The browser-side component can interact with webpages and other resources available to the AI assistant, while the remote AI system provides the reasoning and instructions.

Normally, the browser-side component only accepts commands from a trusted webpage associated with the AI service. This separation is intended to prevent unrelated extensions or websites from directly controlling the AI agent. Researchers found that an extension could potentially interfere with that trusted communication channel and inject its own instructions into the page that the AI system trusted.

The attack did not require unusual permissions. Researchers said the technique relied on two capabilities commonly available to legitimate extensions. One permission allows an extension to modify webpages, while another can be used to alter network requests made by the browser. When combined, those permissions could allow an extension to insert code into a trusted AI webpage and make requests appear to originate from the service itself.

The issue was first demonstrated against Google’s Chrome AI functionality in research known as GlicJack. Google subsequently addressed the Chrome vulnerability, which was assigned CVE-2026-0628. The vulnerability was fixed in Chrome version 143.0.7499.192, according to the researchers.

The newer research extended the same general concept to several other AI-powered products. Researchers reported successful demonstrations involving Perplexity Comet, Microsoft Edge, Opera Neon, and Claude in Chrome. The exact capabilities varied considerably between products, meaning the potential consequences were not identical across all five platforms.

Perplexity’s Comet presented one of the broadest attack scenarios demonstrated by the researchers. Because Comet is designed as an AI-focused browser capable of performing actions for users, a compromised AI agent could potentially gain access to information and functions that would normally be available to the user. The researchers said their demonstration could read local files, access browsing information, take screenshots, and perform actions through the browser.

The Edge demonstration relied on a different combination of weaknesses. Microsoft had already introduced protections designed to prevent extensions from using this type of technique, but researchers said they were able to combine multiple issues, including a timing-related race condition, to manipulate the AI agent’s behavior. Microsoft subsequently fixed the reported issue, which was assigned CVE-2026-55945.

Opera Neon was another example of how AI-focused browsers can introduce new security considerations. Researchers said the AI system trusted pages within Opera’s own domain, creating an opportunity for an extension to inject instructions into a trusted environment. This allowed the researchers to demonstrate control over the AI agent without requiring the user to manually approve each action.

The Claude in Chrome finding was somewhat different because Claude is delivered as a browser extension rather than as a complete browser. Researchers described the issue as an example of one extension being able to interfere with another extension’s functionality. Although the potential impact was more limited than some of the other demonstrations, the finding still showed how interactions between extensions and AI assistants can create unexpected security boundaries.

The research also demonstrated that the potential consequences can extend beyond simply manipulating an AI chatbot. In some environments, researchers were able to demonstrate access to local files, screenshots, browser information, or hardware such as the camera and microphone. The capabilities depended on the specific product and permissions available to the AI system.

Importantly, the research does not mean that every browser extension can automatically take control of these AI systems. The attack begins with the attacker getting an extension installed in the victim’s browser. That could happen through a malicious extension, a compromised legitimate extension, social engineering, or another method of getting unwanted software onto a system.

The findings nevertheless raise an important question about how traditional browser security models should evolve as AI agents become more deeply integrated into browsers. Conventional extensions are generally designed to modify webpages or provide additional browser functionality. AI agents, on the other hand, may have significantly greater authority because they are expected to perform tasks for the user.

That difference creates a potentially important security gap. A low-privilege extension may not need direct access to files, cameras, or other sensitive resources if it can instead manipulate an AI agent that already has permission to use them. In that scenario, the AI becomes an indirect pathway to capabilities that the extension itself could not normally access.

The issue also demonstrates why security boundaries surrounding AI agents need to be carefully designed. An AI assistant may be capable of making decisions and carrying out complicated tasks, but it still needs clear limits on which webpages, extensions, applications, and external services are allowed to give it instructions.

For users, the findings reinforce the importance of keeping browsers and AI applications updated and regularly reviewing installed extensions. Removing extensions that are no longer needed and avoiding software from unfamiliar developers can reduce the opportunity for an attacker to establish the initial foothold required for this type of attack.

The broader lesson is that AI-powered browsers are creating a new layer of security complexity. As assistants gain the ability to browse, access files, interact with applications, and act on behalf of users, compromising the communication between an AI agent and the browser could have consequences that go far beyond a traditional webpage vulnerability.

The research serves as another reminder that securing AI systems is not only about protecting the underlying models. The software surrounding those models—including browsers, extensions, webpages, APIs, and operating-system permissions—can become equally important parts of the security boundary. As AI agents become more integrated into everyday computing, researchers and vendors will need to account for these new interactions when designing and testing their security protections.