Single Browser Extension Could Hijack AI Assistants Across Chrome, Edge, Opera Neon, Comet, and Claude

On September 16, 2026, The Hacker News reported that security researchers at Forever Security have shown that a single browser extension could hijack the AI assistants built into five Chromium-based products. The affected products include Google Chrome's Gemini Live, Perplexity Comet, Microsoft Edge, Opera Neon, and the Claude in Chrome extension.

The researchers demonstrated that once the extension is installed, it can access each product's built-in AI with a single click. This means that a malicious extension could potentially issue commands to the AI assistant, leading to prompt injection, data exfiltration, or other malicious actions performed under the guise of the AI.

The attack requires the user to install the malicious extension, which is a common vector for browser-based threats. The exact technical details of the vulnerability have not been fully disclosed, but the research underscores the importance of reviewing extension permissions and the security of AI integrations in browsers.

As of the report, no official patches have been announced. Browser vendors may need to harden their AI integration interfaces to prevent such hijacking. In the meantime, users are advised to only install extensions from trusted sources and to review the permissions requested by any extension.

The findings are significant because AI assistants are increasingly integrated into browsers, and a compromise could have wide-ranging impacts on user privacy and security. The research also highlights the need for better isolation between extensions and AI features.