One Extension Could Hijack AI Assistants Across Chrome, Comet, Edge, Opera Neon and Claude
- ID
- 25151
- Status
- summarized
- Published
- 16 Sep 2026, 10:36 PM
- Fetched
- 17 Sep 2026, 12:43 AM
- Provider
- The Hacker News
- Category
- security
- Original URL
- https://thehackernews.com/2026/09/one-extension-could-hijack-ai.html
- Source URL
- https://feeds.feedburner.com/TheHackersNews
Summary
- Score
- 7.5
- Created
- 17 Sep 2026, 12:43 AM
- Tags
- Audience
- developersai_agent_userssaas_founders
What happened
Security researcher Gal Weizman at Forever Security demonstrated that a browser extension with just two common permissions (page modification and declarativeNetRequest) can hijack the built-in AI assistants in Chrome, Perplexity Comet, Edge, Opera Neon, and Claude in Chrome by injecting code into the trusted page the AI 'body' listens to. The attack can drive the AI agent to act for the attacker, read local files, and on Chrome, activate the camera and microphone. Google patched the Chrome case (CVE-2026-0628, CVSS 8.8) in January 2026 in Chrome 143.0.7499.192, but the same technique was shown to work against the other four products.
Why it matters
If you are building browser-embedded AI agents or shipping extensions that interact with AI assistants, this reveals a structural flaw: the 'body/brain' trust model where the AI body only accepts commands from a single trusted web page is bypassable via standard extension permissions that many legitimate extensions already request. Audit whether your AI agent's command surface can be reached through DOM manipulation or declarativeNetRequest rules, and treat extension-permission grants as a meaningful attack vector even if your agent only listens to one origin.
Discussion angle
The architecture problem here is that browser AI agents trust a web page origin, but extensions can modify that page — so any extension with ad-blocker-level permissions becomes a potential AI agent hijacker. Discuss whether the current extension permission model is adequate for agents that can read files and control cameras, and what builders of browser-based AI tools should do differently.