One Extension Hijacks AI Agents Across Five Chromium Products via Trusted Page Injection

Forever Security demonstrated that the extension intercepts the single trusted origin each AI body listens to, such as gemini.google.com or testing.perplexity.com. With two common permissions the extension rewrites network traffic and injects its own script, allowing it to issue commands that read local files on Chrome and Comet, activate the camera and microphone on Chrome, and drive agent actions on Comet, Edge, Opera Neon, and Claude. The attacks require the malicious extension to be already installed and running. CVE-2026-0628 received an 8.8 CVSS score after Google patched Chrome 143; CVE-2026-55945 rated 4.2 was fixed in Edge 150. Comet, Opera Neon, and Claude received no CVEs despite similar mechanics. Perplexity paid the largest bounty at $7,000 after researchers used an unhardened test subdomain that bypassed the main page's extension block. The pattern shows vendors treating the browser as a trusted execution environment for agentic AI without isolating the body from extension script injection. This mirrors earlier extension-to-native escalation issues but now affects cross-vendor AI surfaces that share the same Chromium permissions model. Mainstream coverage focused on the demo rather than the architectural assumption that one trusted page equals one trusted source of commands. Microsoft, Google, and Perplexity have each shipped fixes for the reported vectors. Future agent browsers will need explicit isolation boundaries between extensions and AI bodies or risk repeated hijacks as more vendors ship always-on agents with file, camera, and action capabilities.