Beyond Chrome: Risks of Malicious Extensions Across Traditional and AI Browsers

Summary: Extension-based attacks now target every major traditional browser - Chrome, Edge, Firefox, Safari, Brave - as well as AI-powered browsers like ChatGPT's Atlas and Perplexity's Comet, adapting to each environment's security model. The article notes that Chrome's automated and manual review can be bypassed through code obfuscation and delayed attack activation, that Edge's dual Chrome Web Store and Microsoft Add-ons Store access widens the risk surface, and that AI browsers carry a prompt injection vulnerability where attackers trick the browser's AI agent with harmful commands.
Why it matters: AI browsers grant extensions permissions to read and modify web data, interact with APIs, and control browser behavior - and the article warns that unencrypted transmissions and automated collections sent to external services mean many users inside a network can be impacted at once before defenses catch up.

Read the original at The Hacker News ↗