Affected Systems

Chromium-based browsers with embedded AI assistants: Google Chrome (fixed in v143.0.7499.192, Jan 2026), Microsoft Edge (fixed in v150.0.4078.48, July 2026), Perplexity Comet, Opera Neon, and Claude in Chrome extension. Vulnerability requires malicious extension already installed with common permissions (web page modification + declarativeNetRequest).

Exploitation Status

Proof-of-concept demonstrated by Forever Security researchers. No evidence of active exploitation in the wild as of September 16, 2026. Not listed in CISA KEV catalog. Attack requires user to install malicious extension first.

Business Impact

Malicious extensions with two common permissions can hijack AI assistants to execute unauthorized actions. Impact varies by product: Comet allows file reading, browsing history leaks, and screenshots; Chrome enables camera/microphone access and local file reading; Edge and Opera Neon allow AI agent control. Chrome vulnerability (CVE-2026-0628) rated 8.8/10 by CISA; Edge (CVE-2026-55945) rated 4.2/10. Comet, Opera Neon, and Claude in Chrome have no CVE assignments. Patches available for Chrome and Edge; fix status unclear for other three products.

Urgency

🟡 Within a week

Recommended Actions

  • Update Google Chrome to version 143.0.7499.192 or later immediately if using Gemini Live AI features
  • Update Microsoft Edge to version 150.0.4078.48 or later if using built-in AI assistant
  • Audit installed browser extensions across all Chromium-based browsers; remove unnecessary extensions, especially those with declarativeNetRequest and web content modification permissions
  • For Perplexity Comet, Opera Neon, and Claude in Chrome users: verify software is fully updated and monitor vendor security advisories for patch confirmation
  • Implement extension allowlisting policies via Chrome Enterprise or equivalent MDM controls to prevent unauthorized extension installation

---

# Threat Actor Context

Actor Profile

Forever Security is a security research organization that conducts vulnerability research and responsible disclosure. In this case, they are the discovering party, not a threat actor. The research demonstrates proof-of-concept attacks where a malicious browser extension could hijack AI assistants embedded in Chromium-based browsers and products. The research was conducted to identify security weaknesses in AI-integrated browser architectures, with findings disclosed through bug bounty programs. Lead researcher Gal Weizman publicly detailed the initial Chrome vulnerability (GlicJack) in March 2026. Forever Security earned approximately $20,000 in bounties across five affected products, indicating coordinated responsible disclosure to vendors including Google, Perplexity, Microsoft, Opera, and Anthropic.

TTPs (Tactics, Techniques, Procedures)

The research demonstrates a technique where malicious browser extensions exploit two common permissions to hijack AI assistants: (1) content script permissions that modify web pages (similar to ad blockers), and (2) declarativeNetRequest API access that intercepts network traffic. The attack method involves seizing the trusted domain that the AI agent's "body" listens to (e.g., gemini.google.com, perplexity.ai) and injecting malicious code into that trusted page to issue unauthorized commands to the AI agent. This allows the extension to impersonate the legitimate vendor and control the AI assistant. In the Microsoft Edge case, researchers combined two weaknesses: takeover of a whitelisted Microsoft marketing page and exploitation of a race condition to switch the agent between "think" and "act" modes. The Perplexity Comet attack leveraged an unsecured test subdomain (testing.perplexity.com) that lacked the same extension protections as the main domain. All attacks require the victim to have already installed the malicious extension, representing a post-compromise capability rather than initial access.

Targets & Patterns

The research targeted technology companies developing AI-integrated browser products, specifically those building AI assistants into Chromium-based browsers. Affected products include: Google Chrome with Gemini Live, Perplexity Comet (a fully AI-driven browser), Microsoft Edge with built-in AI, Opera Neon, and the Claude in Chrome extension by Anthropic. The targeting pattern focuses on products that embed AI agents with privileged access to browser capabilities including file system access, camera/microphone control, screen capture, and autonomous action-taking. Perplexity Comet represented the highest-risk target due to its fully AI-driven architecture granting broad system permissions. The research impacts users in technology, software development, and artificial intelligence sectors who adopt early AI-integrated browsing tools. The vulnerability pattern affects any browser architecture where an AI agent's "body" (local execution environment) trusts commands from specific web origins that extensions can manipulate.

Historical Context

The Chrome vulnerability (CVE-2026-0628) was first publicly detailed by Forever Security researcher Gal Weizman in March 2026 under the name "GlicJack," though Google had already fixed it in Chrome version 143.0.7499.192 released in early January 2026. This represents a pattern where Forever Security expanded their initial Chrome research methodology to four additional AI-integrated products throughout 2026. The Claude in Chrome finding relates to earlier public research: LayerX Security described a related flaw called "ClaudeBleed" in April 2026, and Manifold Security reported in July 2026 that similar gaps remained in later versions, suggesting Forever Security was the first to report this specific variant to Anthropic. Opera reported discovering the same flaw in Opera Neon independently around the same time as Forever Security but paid a bounty regardless. As of September 16, 2026, neither CVE-2026-0628 nor CVE-2026-55945 appeared on CISA's Known Exploited Vulnerabilities catalog, and no evidence of real-world exploitation exists for any of the five methods.

Defensive Recommendations

  • Audit installed browser extensions regularly and remove unnecessary extensions, particularly those requesting content script modification and declarativeNetRequest permissions that could be combined to hijack AI assistants
  • Update Chrome to version 143.0.7499.192 or later to remediate CVE-2026-0628 (CVSS 8.8), and Microsoft Edge to version 150.0.4078.48 or later to remediate CVE-2026-55945
  • For AI-integrated browsers (Perplexity Comet, Opera Neon) and AI extensions (Claude in Chrome), ensure software is fully updated and monitor vendor security advisories for patches addressing extension-based command injection
  • Implement browser security policies that restrict extension installation to vetted sources and enforce principle of least privilege for extension permissions, especially for users with access to AI assistants that can read files or control system resources
  • Monitor for suspicious extension behavior including unexpected network requests to AI service domains (gemini.google.com, perplexity.ai, etc.) and unauthorized AI agent actions such as file access, camera/microphone activation, or autonomous browsing