One extension commanded the AI in five Chromium browsers by seizing the page each one trusts

The five products share a design. The assistant has a component inside the browser that can see the screen, open files, use the camera and take actions, and a component on the vendor's servers that tells it what to do, according to Forever Security ^[5]. The in-browser half accepts instructions from one origin only, gemini.google.com in Chrome and perplexity.ai in Comet ^[6]. An extension is not supposed to be able to command it: an extension can change web pages, not control the browser itself ^[7]. Forever Security's method was to seize that trusted page and issue the commands through it ^[8].

Two permissions were enough, the researchers said: the one that lets an extension modify web pages, which ad blockers use, and declarativeNetRequest, which changes the browser's network traffic ^[9]. Together they let the extension inject its own code into the trusted page and address the assistant as if it were the vendor ^[9].

Difficulty varied by product. Perplexity had blocked extensions from its main page, so the researchers used a leftover test address, testing.perplexity.com, that was not locked down the same way ^[17]. Comet was the worst case, the researchers said, because Perplexity built it as a fully AI-driven browser: the hijacked agent could list the sites the user had visited, take screenshots and act as the user ^[16]. Opera Neon was the easiest, because its assistant took orders from opera.com and Opera had not stopped extensions from running code on that page ^[24]. Forever Security said Opera had found the same flaw on its own ^[25].

Edge took two bugs. Microsoft had already tried to block the extension trick, so Forever Security took over a Microsoft marketing page that was allowed to send prompts to the Edge assistant, then used a race condition to switch the agent between its "think" and "act" modes at the moment that made it carry out a prompt ^[23].

Forever Security put its own Claude finding last. "Claude in Chrome is a browser extension, not a browser," the company wrote ^[19], and called the finding the least serious in the research because one extension was abusing another ^[18]. Anthropic rated it medium severity and paid a bounty ^[20], and named Forever Security the first to report it ^[21]. LayerX had described a related flaw, called ClaudeBleed, in April, and Manifold Security reported in July that a similar gap remained open in a later version ^[22].

The bounties came to about $20,000 across the five products, Forever Security said, and the per-product figures it published add up to $20,500, a gap of $500 ^[14][15]. The report does not say whether Perplexity, Opera or Anthropic have shipped fixes ^[26].