A single malicious browser extension could seize control of AI assistants across five major Chromium-based browsers and applications, according to researchers at Forever Security. The vulnerability affects Gemini Live in Chrome, Perplexity's Comet, Microsoft Edge, Opera Neon, and the Claude in Chrome extension.
The attack works because these AI assistants share a common architecture built on Chromium. Once a user installs a compromised extension, the attacker gains direct access to each AI assistant with minimal additional steps. The extension can execute commands through the AI interfaces without requiring additional user interaction or authentication.
This vulnerability exposes a structural weakness in how modern AI assistants integrate with browsers. Developers built these tools to work seamlessly within the browser environment, but this convenience created a single point of failure. An extension with broad permissions can intercept communications between the browser and the AI assistant, effectively acting as a man-in-the-middle.
The threat model is straightforward. An attacker could distribute a seemingly legitimate extension through the Chrome Web Store or third-party distribution channels. Users installing the extension for one purpose, unaware of its hidden capabilities, would unknowingly grant it access to their AI assistants. From that moment forward, the attacker could make requests to Gemini, Perplexity, Claude, or Edge's built-in AI under the user's account and without their knowledge.
The implications extend beyond individual users. Organizations deploying these assistants to employees face risks that attackers could manipulate AI responses for sensitive tasks. Someone using Claude to analyze confidential documents could have that data exfiltrated through a compromised extension. A business analyst relying on Perplexity for market research might receive poisoned results or have research data stolen. Microsoft Edge users in enterprise environments become vectors for lateral movement if attackers compromise the AI interface.
Forever Security's research highlights a broader pattern in browser security. Extensions operate with trust levels that often exceed what users understand. Modern browsers like Chrome and Edge allow extensions to request permissions for content scripts that run on all websites and access browser APIs. Users typically approve these permission requests with minimal review, treating the permission dialog as a formality rather than a security decision.
The Chromium-based browser ecosystem compounds this problem. Chrome, Edge, Opera, and similar browsers share underlying code and extension architecture. A technique that works on one platform often works on others. Developers targeting multiple Chromium browsers can leverage shared vulnerabilities rather than discovering unique bugs per browser.
Fixing this requires action at multiple levels. Browser vendors need stricter permission models that prevent extensions from accessing AI assistant APIs unless explicitly required for documented functionality. Users should audit installed extensions regularly and remove anything unnecessary. Security teams should block extension installation through organizational policies if the extension lacks clear business justification.
For developers building AI assistants into browsers, the lesson is clear. Integration convenience must not override security isolation. AI assistants should run in restricted contexts that prevent extensions from directly invoking them. Authentication and authorization checks should apply regardless of where requests originate within the browser.