One Extension Could Hijack AI Assistants Across Chrome, Comet, Edge, Opera Neon and Claude

Security researchers at Forever Security demonstrated a method to hijack AI assistants in multiple Chromium-based browsers and extensions by exploiting browser extension permissions to intercept trusted communication channels. The technique leverages two common extension permissions—content modification and network request manipulation—to inject malicious code into trusted AI service pages, enabling unauthorized access to sensitive capabilities such as file reading, screenshot capture, and AI agent control. While no active exploitation in the wild has been observed, the research highlights critical design flaws in how AI agents are integrated into browsers, with CVE-2026-0628 (Chrome) and CVE-2026-55945 (Edge) officially recognized and patched, while similar issues in Comet, Opera Neon, and Claude in Chrome remain less formally addressed.

AI-extracted · verify before operational use