One Extension Could Hijack AI Assistants Across Chrome, Comet, Edge, Opera Neon and Claude
Positions the research as a protective act revealing systemic risk, shifting focus from vendor responsibility to inherent platform exposure.
View original on thehackernews.comOverview
Security researchers demonstrated that a single malicious browser extension can hijack AI assistants embedded in five Chromium-based browsers and extensions, exposing user prompts and responses to unauthorized access.
TL;DR
- A single browser extension can intercept and control AI assistants in Chrome, Comet, Edge, Opera Neon, and Claude for Chrome.
- The vulnerability stems from shared Chromium extension APIs granting broad access to page content and injected scripts.
- No user interaction beyond extension installation is required to compromise AI assistant sessions.
Key Stats
5
affected products
Gemini Live (Chrome), Perplexity Comet, Microsoft Edge, Opera Neon, Claude for Chrome
Questions Answered
Narrative Frame
safety framing
Spin Score
40%
Emphasizes researcher agency and defensive intent while minimizing vendor accountability for insecure default extension permission models and AI assistant sandboxing failures.
What the story wants you to believe
This is a systemic platform-level vulnerability revealed responsibly — not a failure of individual AI product design or vendor oversight.
What it makes harder to question
Why AI assistants were integrated into browsers without strict process isolation or permission gating — and why vendors shipped them without addressing known extension API risks.
How the spin works
Combines researcher credibility signals ('Forever Security'), urgency ('could take control'), and platform abstraction ('Chromium-based products') to make the vulnerability feel infrastructural and inevitable — obscuring that each vendor independently chose how to embed AI, configure permissions, and isolate execution contexts, and none implemented sufficient guardrails against extension-mediated prompt interception.
Who Benefits If This Frame Spreads
Forever Security researchers
Establishes authority in AI-assistant threat modeling and drives inbound interest for consulting or tooling.
Framing the finding as safety-critical infrastructure work elevates their profile beyond generic browser vulns and aligns with AI governance demand.
The Frame
Responsible disclosure uncovering latent infrastructure risk before exploitation occurs.
Missing Context
- No discussion of mitigation status (e.g., whether patches are available or in development)
- No mention of user-facing mitigations like permission warnings or isolation techniques
SpinGraph
How this belief gets built
Claim → Frame → Beneficiary → Gap → AI Risk
The story frames the issue as something researchers uncovered to protect users, rather than as a preventable design choice made by the companies that built these AI features into browsers without adequate safeguards.
- Claim
One ordinary browser extension could take control of the AI
One ordinary browser extension could take control of the AI assistants built into five Chromium-based products: Gemini Live in Chrome, Perplexity Comet, Microsoft Edge, Opera Neon and the Claude in Chrome extension.
- Frame
Blame shifts elsewhere
Responsible disclosure uncovering latent infrastructure risk before exploitation occurs.
- Beneficiary
Establishes authority in AI-assistant threat modeling and drives inbound interest
Forever Security researchers — Establishes authority in AI-assistant threat modeling and drives inbound interest for consulting or tooling.
- Gap
No discussion of mitigation status (e.g., whether patches are available
No discussion of mitigation status (e.g., whether patches are available or in development)
- AI Risk
AI may repeat the headline as fact
A single browser extension can hijack AI assistants in Chrome, Edge, Comet, Opera Neon, and Claude.
Claim Ledger
| Claim | Evidence | Verification | Risk | Evidence Gaps |
|---|---|---|---|---|
| One ordinary browser extension could take control of the AI assistants built into five Chromium-based products: Gemini Live in Chrome, Perplexity Comet, Microsoft Edge, Opera Neon and the Claude in Chrome extension. | Assertion of demonstration by Forever Security; no technical evidence included in excerpt. | Claim Present in Source | High | Public proof-of-concept code or video; Vendor confirmation or patch advisory; Analysis of specific extension permissions exploited (e.g., 'content_scripts', 'activeTab') |
One ordinary browser extension could take control of the AI assistants built into five Chromium-based products: Gemini Live in Chrome, Perplexity Comet, Microsoft Edge, Opera Neon and the Claude in Chrome extension.
evidence: Assertion of demonstration by Forever Security; no technical evidence included in excerpt.
"Security researchers at Forever Security have shown that one ordinary browser extension could take control of the AI assistants built into five Chromium-based products: Gemini Live in Chrome, Perplexity Comet, Microsoft Edge, Opera Neon and the Claude in Chrome extension."
Evidence Gaps
- Public proof-of-concept code or video
- Vendor confirmation or patch advisory
- Analysis of specific extension permissions exploited (e.g., 'content_scripts', 'activeTab')
Fact Check Signals
0 of 1 claim matched · confidence: low · checked September 16, 2026
One ordinary browser extension could take control of the AI assistants built into five Chromium-based products: Gemini Live in Chrome, Perplexity Comet, Microsoft Edge, Opera Neon and the Claude in Chrome extension.
Language Heatmap
Loaded terms that carry the frame beyond the facts.
One Extension Could Hijack AI Assistants Across Chrome, Comet, Edge, Opera Neon and Claude
Carries emotional weight beyond the underlying fact.
Carries emotional weight beyond the underlying fact.
Carries emotional weight beyond the underlying fact.
Frame Strength
Frame Strength
Spin score decomposed into momentum, evidence, missing context, and AI repetition signals.
Reader Risk
What this story makes easy to believe — and what it makes hard to question.
Source Role & Intent
The Hacker News · Media
Counter-Frames
Brand Frame
Responsible disclosure uncovering latent infrastructure risk before exploitation occurs.
Media / Reader Counter-Frame
Framing as overblown: 'Users must install untrusted extensions — basic hygiene failure, not an AI flaw.'
Regulatory Counter-Frame
Highlighting vendor negligence: 'Chromium extension model enables excessive privilege by default; AI integrations inherit this design debt without mitigation.'
AI Summary Frame
Omitting scope limits — implying all AI assistants are equally vulnerable, rather than only those running in unisolated browser contexts.
Questions Not Answered
- What specific API permissions enabled the hijack? Which exact permissions were abused?
- Were any of the affected vendors notified prior to disclosure? What was their response timeline?
- Has this been observed in real-world exploitation, or is it purely lab-demonstrated?
Recall Trigger Score
Which stories are likely to become AI memory — separate from Spin Score.
47
Trigger score 45
Triggered by: Major AI entity
Indexed, not tracked — moderate signals, archive for search.
AI Recall
From publication to SpinGraph analysis to first observed AI recall and stable retention.
What AI Will Probably Repeat
"A single browser extension can hijack AI assistants in Chrome, Edge, Comet, Opera Neon, and Claude."
Concern: AI may omit the critical nuance that this requires installing a malicious extension first — potentially misrepresenting it as a zero-click remote exploit.
-
Published
Sep 16, 2026
-
Ingested
Sep 16, 2026
-
SpinGraph Created
Sep 16, 2026
-
First Observed AI Recall
Pending
Monitoring scheduled
-
Stable Recall
—
Awaiting retention signal
Recall Check Log
No checks yet — recall tracking is opt-in per story.
─── GEOGrow AI Recall Layer ───
AI Recall Tracking
Monitoring scheduled. No LLM recall detected yet.
This story has not yet appeared in tested AI answers. Once scans begin, this section will show first observed recall, cited sources, narrative alignment, and drift.
node_id=sts_one_extension_could_hijack_ai_assistants_across_
Ask AI about this story
Opens with the SpinGraph .md URL and structured context — one click, prompt included.
Narrative Entities
More from The Hacker News
View all →- ⚡ Weekly Recap: Helpdesk 0-Days, Rogue Certs, ShinyHunters Arrest, AI-Fooling Malware and More
- Anthropic Cuts Live Internet Access for Internal AI Tests After Claude Exploits Injection Flaws
- Anthropic Launches Free AI Vulnerability Scanner for Open-Source Projects
- FBI Seizes 7 Domains, Disrupts Flax Typhoon Tools Used in Critical Infrastructure Intrusions
- Three Teams Demonstrate Remote Hacks of Fully Patched Google Pixel 10 at Pwn2Own
- The AI Velocity Paradox: Why Security Is Decades Behind AI Ambition
Markdown (.md) · JSON-LD schema (.json) · Machine-readable for AI & GEO