Full Report
Security researchers at Forever Security have shown that one ordinary browser extension could take control of the AI assistants built into five Chromium-based products: Gemini Live in Chrome, Perplexity Comet, Microsoft Edge, Opera Neon and the Claude in Chrome extension. Once the extension was installed, it could access each product's built-in AI with a single click. On Comet, Edge,
Analysis Summary
# Vulnerability: Multi-Browser AI Assistant Hijacking via Malicious Extensions
## CVE Details
- **CVE ID:**
- **CVE-2026-0628** (Google Chrome / Gemini Live)
- **CVE-2026-55945** (Microsoft Edge)
- *Note: Comet, Opera Neon, and Claude in Chrome do not have assigned CVEs.*
- **CVSS Score:**
- 8.8 (High) - CVE-2026-0628
- 4.2 (Medium) - CVE-2026-55945
- **CWE:** Not specified (Technique involves Cross-Extension/Cross-Context Scripting via permission abuse).
## Affected Systems
- **Products:**
- Google Chrome (Gemini Live)
- Perplexity Comet (AI-driven browser)
- Microsoft Edge
- Opera Neon
- Claude in Chrome (Anthropic Extension)
- **Versions:**
- Chrome: Versions prior to 143.0.7499.192
- Edge: Versions prior to 150.0.4078.48
- Comet/Opera/Claude: Specific vulnerable versions not listed, but flaws were verified by researchers in 2026.
- **Configurations:** Systems where a malicious browser extension is installed with `declarativeNetRequest` and web page modification permissions.
## Vulnerability Description
The flaw resides in how Chromium-based AI assistants communicate between their "body" (the browser-side interface) and their "brain" (vendor servers). AI assistants typically only accept commands from a "trusted" web page (e.g., `gemini.google.com`).
Researchers discovered that an extension with two common permissions—ad-blocker-style page modification and `declarativeNetRequest`—can hijack this trusted page. By injecting code into the trusted domain and manipulating network traffic, the extension can impersonate the vendor and issue unauthorized commands to the AI agent.
## Exploitation
- **Status:** PoC available (Researcher demonstrated; no evidence of exploitation in the wild).
- **Complexity:** Medium (Requires a malicious extension to be installed by the user).
- **Attack Vector:** Local (Browser Extension).
## Impact
- **Confidentiality:** **High.** In Chrome and Comet, attackers can read local files, take screenshots, and leak browsing history/profiles. In Chrome, attackers can also access the camera and microphone.
- **Integrity:** **High.** Attackers can control the AI agent to act on behalf of the user (sending messages, performing actions).
- **Availability:** **Low.** Primary impact is data theft and unauthorized action rather than service disruption.
## Remediation
### Patches
- **Google Chrome:** Update to version **143.0.7499.192** or later.
- **Microsoft Edge:** Update to version **150.0.4078.48** or later.
- **Perplexity Comet / Anthropic / Opera:** Users should ensure they are running the latest versions of these applications/extensions, as vendors have issued bug bounties and internal fixes.
### Workarounds
- **Least Privilege:** Audit installed browser extensions and remove those requiring broad permissions (like "Read and change all your data on all websites") unless strictly necessary.
- **Enterprise Controls:** Use browser management policies to block the installation of unapproved or high-risk extensions.
## Detection
- **Indicators of Compromise:** Presence of unauthorized or suspicious browser extensions.
- **Detection Methods:** Monitor for unusual network requests originating from the browser to AI vendor domains that bypass standard user interface triggers.
## References
- **Forever Security Research:** hxxps://forever[.]security/blog/bragjack-hijacking-5-browsers-via-built-in-ai-assistants
- **NVD CVE-2026-0628:** hxxps://nvd[.]nist[.]gov/vuln/detail/CVE-2026-0628
- **NVD CVE-2026-55945:** hxxps://nvd[.]nist[.]gov/vuln/detail/CVE-2026-55945
- **Original GlicJack Research:** hxxps://thehackernews[.]com/2026/03/new-chrome-vulnerability-let-malicious[.]html