As reported by The Hacker News, security researchers at Forever Security have demonstrated that a single browser extension with two common permissions — page modification and declarativeNetRequest — can commandeer the AI assistants embedded in five Chromium-based products. The attack class, dubbed GlicJack by researcher Gal Weizman, exploits a fundamental trust boundary problem: the AI "body" running inside the browser accepts instructions from a trusted web origin, but that origin can be silently compromised by any extension with content-script capabilities.
Why This Matters Beyond the CVEs
The technical novelty here is not exotic. The researchers used permissions that millions of legitimate extensions already request — ad blockers, password managers, productivity tools. What makes this significant is the blast radius once that trust boundary breaks. These AI assistants are not passive chatbots. They can read local files, activate hardware sensors, and execute agentic actions on behalf of the user. A compromised extension effectively gains a capable proxy with the user's own privileges and the AI vendor's trust — a combination that traditional endpoint security is not designed to detect.
The core issue is architectural: browser vendors are bolting agentic AI onto a trust model that was never designed for autonomous action execution. Content script isolation was built to protect page integrity, not to serve as a security boundary for an AI agent that can read your filesystem.
Vulnerability Summary
| Product | CVE | CVSS | Status | Patch Version |
|---|---|---|---|---|
| Google Chrome (Gemini Live) | CVE-2026-0628 | 8.8 (High) | Patched | 143.0.7499.192 (Jan 2026) |
| Microsoft Edge | CVE-2026-55945 | 4.2 (Medium) | Patched | 150.0.4078.48 (Jul 2, 2026) |
| Perplexity Comet | None assigned | — | Unpatched (per research) | — |
| Opera Neon | None assigned | — | Unpatched (per research) | — |
| Claude (Chrome extension) | None assigned | — | Unpatched (per research) | — |
Active exploitation: None observed. These are researcher demonstrations requiring a malicious or compromised extension already installed in the victim's browser.
Who Is Most Exposed
Shield53 Recommendations
Immediate Actions
- Update Chrome to version 143.0.7499.192 or later if not already deployed; verify via
chrome://version - Update Edge to version 150.0.4078.48 or later
- Audit installed extensions across all Chromium browsers — remove any extension requesting both
declarativeNetRequestand content-script/host permissions that is not from a verified publisher - Enforce extension allowlists via Group Policy or MDM for managed fleets; block sideloaded and developer-mode extensions on production machines
- Disable AI assistant filesystem and hardware access where not operationally required — restrict camera/microphone and local file permissions in browser settings
- For Comet, Opera Neon, and Claude extension users: treat AI assistant features as untrusted until vendors confirm remediation; consider disabling the assistant or using it in a separate browser profile with no other extensions installed
Detection Considerations
- Monitor for extensions requesting
declarativeNetRequestalongsidehost_permissionsfor AI vendor domains (gemini.google.com, perplexity.ai, claude.ai) - EDR rules should flag unexpected file access or camera/microphone activation originating from browser processes
- Review browser extension telemetry for content script injection into trusted AI assistant origins
Strategic Outlook
The gap between Chrome's 8.8 CVSS and Edge's 4.2 — and the absence of CVEs for three products — suggests the industry has not yet converged on how to score AI-agent trust boundary violations. Security teams should not wait for CVE assignments to treat unpatched AI assistant surfaces as elevated risk. The agentic browser is becoming the new endpoint, and extension governance is now a first-tier control, not a productivity afterthought.
