One Browser Extension Hijacks 5 Browsers via Built-in AI Assistants, $20K in Bounties
galwm · hn · 2026-09-17
A security researcher demonstrated that a single browser extension can hijack 5 major browsers through their built-in AI assistants. The attack chain earned $20K in bounties from Anthropic, Perplexity, Google, and Microsoft.
More from Safety
- JPMorgan, Schwab and Amazon block AI shopping agents; Schwab says it stops dozens of attempts weekly — emmanuelvivier · 2026-11-02
- OpenAI tightens protections for under-18 users, first community safety report due early 2027 — emmanuelvivier · 2026-11-02
- Malicious npm cluster posing as AI SDKs harvests AWS credentials, dating back to October — cyb3rops · 2026-11-02
- Self-Hosting LLMs at a Law Firm: Infra and Data Governance Harder Than the Model — EducationalGroup7245 · 2026-11-02
- TAWA GUARD Launches Pre-Model Input Checks to Block Hidden Prompt Injections in Agent Inputs — TawaGuard · 2026-11-02
- Warning: AI-enabled cyber attacks are outpacing hand-crafted defenses — uwukko · 2026-11-02