Prompt Forcing, typed into five browser agents

Google's Gemini assistant in Chrome is split in two. The body is the browser itself, which can screenshot tabs, turn on the camera and microphone, and read user data. The brain is Gemini on Google's servers, reached over the internet. A prompt typed into the side panel travels to the servers, and the instructions come back to be executed on the machine. Gal Weizman of Forever Security asked what would happen if the brain could be made to send commands the body should refuse.

An extension normally edits websites and nothing more, and browser makers defend that line closely. Two abilities extensions hold by default turned out to be enough to cross it. Content scripts inject JavaScript into pages, and the declarativeNetRequest API rewrites traffic between the browser and the network. Google blocked extensions from running scripts on its Gemini page but left the network-rewriting ability open. The extension swapped a JavaScript asset from Google for one served by the attacker, which put attacker code inside the browser and gave it the body's powers, including reading files off the operating system. Google paid a $7,000 bounty and shipped a fix for what became CVE-2026-0628.

The novelty is what the attacker controls. Prompt injection appends a malicious ending to a prompt someone else wrote. Here the extension writes the entire prompt and sends it, then keeps sending follow-ups and chaining them, a technique Forever named Prompt Forcing. No malicious code runs, because the trusted assistant is only doing what it is allowed to do, so an endpoint tool that looks for payloads has nothing to find. The attacker also does not need a fixed exploit: the agent can work out the steps on the fly, which means the defender cannot know in advance what to block.

Opera's Neon was the easiest. Its assistant accepts requests only from opera.com, and unlike Google, Opera left that domain open to extension content scripts. Weizman injected a script, then typed prompts such as asking the agent to summarize the victim's finance emails and send them onward, which it did. The network-rewriting ability hid the activity from the user. Opera paid $900.

Microsoft's Edge tried to stop the technique, which led to a stranger flaw. The assistant takes orders from copilot.microsoft.com, and Microsoft also created a marketing page that could open the side panel with a prompt already loaded. The browser granted a permission to send prompts to that one page, not to the whole domain, something Weizman had not seen in years of browser research. The page's defenses blocked the usual network trick, so he bypassed it by changing headers instead of deleting them. Microsoft had also split the agent into a Think mode that accepts prompts and a Do mode that takes actions, a safety measure that prevents one component from doing both. He set the agent thinking, then switched it to Do while it was still working, and it acted on his prompt. Microsoft classified the race condition as CVE-2026-55945 and paid $5,000.

Claude in Chrome is itself an extension, and Anthropic made the same marketing-page mistake, letting that page send any prompt to the assistant rather than a fixed handful. Because Anthropic owns only the extension and not a browser, it could not block a content script on its own domain, so Weizman ran his extension there and could send any message to the assistant. Anthropic rated it medium severity and paid $600.

Perplexity's Comet was the worst, because the whole browser is agentic and the agent holds every permission the browser has. Perplexity blocked extensions from running on perplexity.ai entirely, so none of the earlier techniques worked. Reading the code, Weizman found a second address the agent would accept commands from, a leftover testing domain that redirected to the real site before anyone could land on it. The redirect is only an instruction in the response headers, and an extension can rewrite headers. He blocked the redirect, loaded the testing page quietly, injected code, and could then send arbitrary messages to the agent: screenshots of everything the user did, the full browsing history, and reads of any file on the operating system, all with no clicks from the user. Perplexity paid a $7,000 bounty.

The five flaws share one root cause: software on the endpoint now embeds an AI that trusts one page or one domain too much, and an extension is enough to reach it. The impact table in the research lists local file access, camera and microphone, browser-profile and history leaks, screenshots, and full agent hijack spread across the five browsers, with zero clicks required in every case. The bounties from Google, Anthropic, Microsoft, Perplexity, and Opera totaled tens of thousands of dollars.

Forever's own conclusion is a sales pitch for runtime monitoring, but the detection problem it names is real. The attack runs no malware and issues no exploit payload, only plain-language instructions through software that is allowed to act, so a signature-based endpoint tool sees nothing to match. Weizman argues the defender has to judge every action in the context it was taken rather than checking whether a program is permitted to act at all. The two CVE fixes are shipped: Chrome 143.0.7499.192 and Edge 150.0.4078.48, and the other three vendors paid bounties and acknowledged the findings.