Loading story…
Forever Security disclosed BragJack, a proof-of-concept attack in which a malicious browser extension can abuse trusted communication paths between webpages and browser-based AI assistants to issue commands appearing to originate from a vendor-authorized source. The technique affected Gemini Live in Chrome, Microsoft Edge Copilot, Opera Neon, Perplexity Comet, and Claude in Chrome; potential impact ranged from AI-agent control to access to local files, browser-profile data, browsing history, screenshots, and—in Chrome—camera and microphone access.
Exploitation requires a victim to install and run the malicious extension, which can use webpage-modification capabilities and declarativeNetRequest rules to manipulate trusted origins, resources, or message channels. Google fixed the Chrome Gemini flaw, tracked as CVE-2026-0628 (CVSS 8.8), in Chrome 143.0.7499.192/.193, while Microsoft fixed the Edge Copilot race condition, CVE-2026-55945, in Edge 150.0.4078.48. Researchers reported no evidence of in-the-wild exploitation; organizations should patch affected browsers, allowlist extensions, restrict broad host, DNR, and debugger permissions, and monitor sensitive AI-agent activity.
Track how attackers are adapting to this technology.
4 events from the most recent confirmed update back to the earliest known activity.
Microsoft fixed the Edge Copilot race-condition issue tracked as CVE-2026-55945 in Edge version 150.0.4078.48. The issue could enable forced prompts by timing a switch between Copilot's Think and Do modes.
The affected vendors awarded Forever Security approximately $20,000 in combined bug bounties for the reported findings, including rewards from Google, Perplexity, Microsoft, Opera, and Anthropic. Anthropic rated the Claude in Chrome finding as medium severity and said it was the first report of that issue.
Google fixed the high-severity Chrome Gemini issue CVE-2026-0628, also described as GlicJack, in Chrome 143.0.7499.192 and .193. The flaw allowed declarativeNetRequest rules to replace a resource in Gemini's trusted WebView context after a malicious extension was installed.
Forever Security researcher Gal Weizman demonstrated that a malicious installed extension could abuse trusted browser-to-AI communication paths to control AI assistants in Chrome Gemini, Perplexity Comet, Edge Copilot, Opera Neon, and Claude in Chrome. The demonstrations showed potential access to sensitive capabilities including local files, screenshots, browser data, and—in Chrome—camera and microphone access.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
2 references tracked. Mallory keeps watching after this page renders.
cryptika.com
Open sourcethehackernews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Palo Alto Networks Unit 42 disclosed a **high-severity Google Chrome vulnerability** in the new **Gemini Live in Chrome** side panel, tracked as **CVE-2026-0628**, that could have allowed **malicious browser extensions with only basic permissions** to hijack the Gemini panel and effectively “tap into” the browser environment. The reported impact included **privilege escalation** enabling access to sensitive resources such as the victim’s **camera and microphone**, the ability to **take screenshots of any website**, and access to **local files and directories**. Unit 42 reported responsible disclosure to Google and stated that Google shipped a fix in **early January** ahead of public disclosure. Dark Reading coverage echoed Unit 42’s findings, emphasizing that the flaw highlights emerging risks in **agentic/AI-enabled browsers** where AI side panels run with elevated capabilities, and that enterprise environments face amplified exposure if users install untrusted extensions. Separate reporting described unrelated supply-chain activity affecting developer and browser extensions: Socket reported suspicious, non-repository code added to **Aqua Trivy’s VS Code extension** on **OpenVSX** (versions `1.8.12`/`1.8.13`) that attempted to invoke local AI coding assistants and exfiltrate/report data, while Rescana detailed a **QuickLens Chrome extension** takeover used for credential/crypto theft and a **ClickFix** social-engineering technique; these are distinct incidents from CVE-2026-0628 but reinforce the broader risk of extension ecosystems.
Jun 29, 2026
Researchers at Cato Networks have identified a new attack technique called **HashJack**, which leverages the fragment portion of URLs (the section after the `#` symbol) to hide malicious prompts. This method specifically targets AI browser assistants such as Copilot in Edge, Gemini in Chrome, and Comet from Perplexity AI. When users interact with these AI-powered browsers, the hidden instructions in the URL fragment are processed by the large language model, potentially leading to outcomes like data exfiltration, phishing, misinformation, malware guidance, or even harmful medical advice. Traditional network and server-side defenses are unable to detect these attacks because URL fragments are never transmitted beyond the client, making legitimate websites unwitting vectors for exploitation. The HashJack attack is a form of indirect prompt injection, where attackers craft links to trusted sites with appended malicious instructions after the `#` symbol. Unsuspecting users who click these links and then use their AI browser assistant may trigger the hidden prompts, which can manipulate the assistant to perform harmful actions or leak sensitive data. The risk is heightened in agentic AI browsers, where the assistant may autonomously send user data to attacker-controlled endpoints. Security researchers warn that this technique can weaponize any legitimate website, underscoring the urgent need for improved defenses in AI browser architectures against prompt injection threats.
Jun 29, 2026
Security researchers reported multiple risks tied to **AI-themed browser extensions** in the Chrome/Edge ecosystem, including active malicious campaigns. Malwarebytes identified **16 malicious extensions** (15 Chrome, 1 Edge) masquerading as ChatGPT “enhancers” that **steal ChatGPT session tokens**, enabling attackers to take over accounts and access conversation history and metadata; the extensions also exfiltrate additional telemetry (e.g., extension version/language and usage details) to help attackers profile victims and maintain longer-term access. Separately, Varonis described a new **malware-as-a-service** offering called **“Stanley”** that claims to reliably get **phishing-capable Chrome extensions** through Chrome Web Store review, using full-screen `iframe` overlays to present attacker-controlled login pages while the address bar continues to show the legitimate domain; it also advertises auto-install support across Chrome/Edge/Brave, a management panel, geo/IP targeting, and frequent C2 polling. In parallel with these overtly malicious cases, an Incogni study of **442 AI-powered Chrome extensions** found broad privacy and security exposure from over-privileged extensions (e.g., script injection and deep page access) and extensive data collection (52% collecting user data), highlighting that even popular tools (e.g., **Grammarly** and **QuillBot**) can present significant privacy risk due to the scope of permissions and data categories collected.
Jun 29, 2026