One browser extension hijacked five AI browser assistants for $20K in bounties

What happened

A single browser extension managed to take control of five different AI browser assistants — Gemini in Chrome, Perplexity's Comet, Copilot in Edge, Opera Neon, and Claude in Chrome — and the work earned roughly $20,000 in bug bounties from Anthropic, Google, Microsoft, and Perplexity. According to a dev.to write-up of the research, the striking part is not the payout: the extension contained no malicious code and did not exploit five separate bugs. It abused one architectural weakness that every one of those products happened to share.

How the hijack works

Modern browser assistants are not autocomplete bars. As the dev.to piece explains, they capture screenshots, read files, send email, and act with the user's session and permissions. Browser extensions, meanwhile, occupy an unusually privileged spot in the stack: they can observe and alter network traffic that ordinary page code cannot touch. If an extension can tamper with the requests travelling between an assistant and its cloud backend, and that backend accepts those requests without checking where they came from, the extension is effectively steering an agent that already holds the user's credentials.

The author frames this as an old lesson being relearned. Whenever a privileged middle layer trusts input arriving from a less-trusted one, the result is an injection point. The browser and DOM ecosystem spent roughly fifteen years internalising that idea; the new wave of AI agents embedded in browsers is repeating the lesson with far higher stakes, because the compromised layer can now send mail and touch the filesystem.

One flaw, five products

The convergence is what the dev.to author calls the real story. Five independently built assistants arriving at the same weak assumption — that a request originating from the browser's extension layer can be trusted at face value — suggests vendors shipped their "AI in your browser" features on near-identical timelines without ever comparing notes on what happens when extensions meet autonomous agents.

The piece also cautions against both directions of hype. Vendors prefer to describe the episode as responsibly disclosed, quickly patched, and proof the system worked as intended. Researchers prefer to point out that one extension broke five browsers and to invite readers to imagine what a well-funded attacker could do. Both framings, the author argues, are technically true and individually incomplete. The author adds that this class of bug was findable by design rather than by luck: anyone who has reviewed extension security over the past decade knew extensions could see and modify traffic others cannot, and bolting a high-trust agent onto that same surface made it a far more interesting target.

Implications for teams

For developers building on agentic browser features, the assumption that they are a thin interface over a language model no longer holds. They are privileged execution surfaces and need to be threat-modelled accordingly, not treated as a chat widget attached to a search bar.

For security teams, extension allowlist policies carry new weight. An add-on that looked harmless eighteen months ago — intercepting traffic for ad blocking or price comparison, say — now runs alongside an agent with access to email and files. Enterprise policies written before that shift in the trust boundary are likely out of date.

The author also predicts more findings of this shape: attacks that require no malware and no user click at all, only a request that looks legitimate enough to whichever layer fails to verify it.

Why it matters

This is a class of vulnerability rather than an isolated incident, and it surfaced simultaneously across Chrome, Edge, Opera and dedicated assistant browsers. It shows that the race to embed agents in browsers produced a common blind spot that nobody had priced in: requests moving between the extension layer and assistant backends were trusted without provenance checks. The open question the piece leaves readers with is whether per-vendor patches are an adequate response, or whether the industry needs a shared standard governing how browser extensions and agentic AI features are allowed to interact in the first place.