Five Chromium products ship an assistant that can read local files, watch the screen and turn on the camera. Forever Security has shown that even an ordinary extension, with no special privileges, can seize those powers. It covered Claude in Chrome, Opera Neon, Microsoft Edge, Perplexity Comet and Gemini Live in Chrome.
The design is shared: the model runs on the vendor’s servers, while a local agent inside the browser reads the screen, opens files, operates the camera and carries out orders. That agent answers to one trusted origin, such as gemini.google.com on Chrome or perplexity.ai on Comet.
The way in was that trusted origin: Forever Security captured it, then relayed commands through it. Two permissions extensions commonly hold were enough; no click was needed in any of the five. One alters web pages, as ad blockers do. The other, declarativeNetRequest, redirects network traffic.
Chrome came first. Google fixed it in Chrome 143.0.7499.192 in early January 2026, months after Gal Weizman of Forever Security published the technique as GlicJack. CISA scored Chrome’s flaw 8.8 under CVE-2026-0628. Edge is the only other product with an identifier: CVE-2026-55945, a 4.2, fixed on July 2 in Edge 150.0.4078.48.
Neither Comet nor Opera Neon nor Claude in Chrome has an identifier; those three rest on the researchers’ account. Comet was the worst case. Its assistant acts rather than chats, so a hijacked agent could pull any local file, replay browsing history, grab screenshots and pose as the user.
Claude in Chrome produced the least severe finding, since here one extension was abusing another rather than a browser. Anthropic judged the severity medium and paid a bounty, part of the roughly $20,000 that Forever Security says it earned across the five. Patch what can be patched and audit which extensions can rewrite traffic.
