One Extension Could Hijack AI Assistants Across Chrome, Comet, Edge, Opera Neon and Claude
Summary: Forever Security researchers demonstrated that a single browser extension with two common permissions could take control of the built-in AI assistants in Gemini Live in Chrome, Perplexity Comet, Microsoft Edge, Opera Neon and the Claude in Chrome extension. The Chrome flaw, called GlicJack and tracked as CVE-2026-0628, was rated 8.8 by CISA and fixed in Chrome version 143.0.7499.192, while only the Edge finding also received a CVE, CVE-2026-55945, rated 4.2 and fixed in Edge version 150.0.4078.48 on July 2.
Key Takeaway: The researchers said Comet was the worst case: once hijacked, its agent could read any file on the computer, list visited sites, take screenshots and act as the user. Every method assumes the attacker has already gotten the user to install the extension, the same starting point as many other browser attacks.
Read the original at The Hacker News ↗
- Topics
- Zero-Days & Exploits
- Mentions
- CVE-2026-0628CVE-2026-55945
- Related