Security researchers have revealed a serious flaw that allows a browser extension to commandeer built-in AI assistants in five Chromium-based platforms: Chrome’s Gemini Live, Comet, Microsoft Edge, Opera Neon, and the Claude extension in Chrome. Once installed, the malicious extension could issue commands to the AI, access sensitive resources like files, and even activate the camera and microphone under certain configurations. The issue does not appear to have yet been exploited in real-world attacks.
What researchers discovered
The findings are the result of a study by Forever Security showing how a browser extension could hijack the “body” of the browser-based AI (the part that reads the screen, opens files, uses peripherals like camera/microphone) by impersonating one of its trusted web pages. These trusted pages normally control what the body does, while the “brain” component—that lives on vendor servers—decides how it responds.
In the exploit, the extension needs only two permissions: one to alter web pages (often used by ad blockers), and the other called declarativeNetRequest, which controls how network requests are handled. Together, they allow it to inject commands into the trusted page, tricking the AI into thinking it’s receiving instructions from the vendor itself.
Affected AI platforms and scope
Here’s a breakdown of what the exploit could achieve on each affected product: Chrome could allow file access, screen capture, and use of camera & microphone. In Comet, Edge, Opera Neon, and Claude in Chrome, the extension could fully control the AI agent’s actions. Only Chrome and Comet would let the attacker read files from the user’s device.
Among the five, Comet emerged as the riskiest: researchers demonstrated it could expose users’ full file system, site history, screenshots, and more. Its alias as an AI-centric browser gives it broader access than other assistants. Conversely, the Claude in Chrome extension presented the lowest risk due to limitations tied to its architecture.
Patches, status, and recommendations
Two of the five platforms—Chrome and Edge—already issued fixes. Chrome patched the issue in version 143.0.7499.192 (CVE-2026-0628); Edge fixed its version (150.0.4078.48) in early July (CVE-2026-55945).
The other three—Comet, Opera Neon, and Claude in Chrome—have had the flaw acknowledged and bug bounty payments made, but no public confirmation yet of a full fix. Users of those platforms are strongly advised to stay current on updates and carefully review any extensions they’ve installed.
Broader implications
This vulnerability highlights the risks inherent in embedding AI agents directly into browsers. Such designs blur the boundaries between low-privileged browser extensions (which many users trust) and high-privilege AI components that control sensitive system parts. Normally, browsers aim to prevent extensions from interfering with core browser functions—this exploit bypasses those safeguards.
While none of these methods have been observed in active attacks, the prerequisites are common: the user must install the extension beforehand. That puts extension permissions—and vigilance over what’s installed in one’s browser—squarely in the center of protection.
The discovery underscores a turning point: integrating AI into browsers unlocks powerful capabilities, but also revives attack vectors that browser architecture has long tried to seal off. What’s needed now is a rethink of how permissions are granted and how browsers isolate trusted AI “bodies” from extension interference. Watch for rigorous fixes, clearer permission models, and tighter controls over which extensions may access AI control paths.
