Malicious Browser Extensions Can Hijack AI Assistants in Chrome, Edge, Comet, Opera Neon and Claude — Enterprise Defense Guide

---
title: Suspicious Chromium Extension Installed Outside Managed Policy
id: 3f8a2b14-7c91-4d52-9e06-2a7c5d1f8b33
status: experimental
description: Detects Chromium-based browser extension registration in user-writable profile paths where the extension ID is not present in enterprise force-install or allowlist policy. Malicious extensions that hijack browser AI assistants must first land in the profile Extensions directory.
references:
  - https://thehackernews.com/2026/09/one-extension-could-hijack-ai.html
  - https://attack.mitre.org/techniques/T1176/
author: Security Arsenal
date: 2026/09/15
tags:
  - attack.persistence
  - attack.t1176
logsource:
  category: file_event
  product: windows
detection:
  selection_path:
    TargetFilename|contains:
      - '\AppData\Local\Google\Chrome\User Data\Default\Extensions\'
      - '\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\'
      - '\AppData\Roaming\Opera Software\'
      - '\AppData\Local\Comet\User Data\Default\Extensions\'
  selection_file:
    TargetFilename|endswith:
      - '\manifest.json'
  condition: selection_path and selection_file
falsepositives:
  - Legitimate user-installed extensions from official stores
  - Extensions deployed by developer tooling (React DevTools etc.)
level: medium
---
title: Chromium Browser Launched With Extension Load or Debugging Flags
id: 8c1e5f72-3a40-4b89-a1d7-6e2c9f04b7d5
status: experimental
description: Detects Chrome, Edge, Comet, or Opera Neon processes started with flags used to sideload unpacked extensions or enable remote debugging - both of which can be abused to inject extension-level control of built-in AI assistants outside the store review process.
references:
  - https://thehackernews.com/2026/09/one-extension-could-hijack-ai.html
  - https://attack.mitre.org/techniques/T1176/
author: Security Arsenal
date: 2026/09/15
tags:
  - attack.persistence
  - attack.defense_evasion
  - attack.t1176
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\opera.exe'
      - '\neon.exe'
      - '\comet.exe'
  selection_flags:
    CommandLine|contains:
      - '--load-extension'
      - '--disable-extensions-except'
      - '--remote-debugging-port'
      - '--remote-debugging-pipe'
  filter_legit_dev:
    CommandLine|contains:
      - 'ms-playwright'
      - 'puppeteer'
      - 'selenium'
      - 'chromedriver'
  condition: selection_img and selection_flags and not filter_legit_dev
falsepositives:
  - QA automation frameworks and developer workstations - tune per-host baseline
level: high
---
title: Registry-Based Chromium Extension Policy Tampering
id: 5b2d9e61-8f34-4a17-b2c8-9d0e3f6a1c44
status: experimental
description: Detects modification of Chromium ExtensionInstallForceList or ExtensionInstallBlocklist policy registry keys. Attackers and malicious installers use force-list entries to silently persist extensions that can drive built-in AI assistants.
references:
  - https://thehackernews.com/2026/09/one-extension-could-hijack-ai.html
  - https://attack.mitre.org/techniques/T1112/
author: Security Arsenal
date: 2026/09/15
tags:
  - attack.persistence
  - attack.defense_evasion
  - attack.t1112
  - attack.t1176
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|contains:
      - '\Policies\Google\Chrome\ExtensionInstallForcelist'
      - '\Policies\Microsoft\Edge\ExtensionInstallForcelist'
      - '\Policies\Google\Chrome\ExtensionInstallBlocklist'
      - '\Policies\Microsoft\Edge\ExtensionInstallBlocklist'
  filter_mgmt:
    Image|endswith:
      - '\gpscript.exe'
      - '\GroupPolicyMgmt.exe'
      - '\IntuneManagementExtension.exe'
  condition: selection and not filter_mgmt
falsepositives:
  - Managed GPO/Intune policy deployment outside filtered processes
level: high

// Hunt: New browser extension manifests appearing on endpoints, correlated against known-good baseline
// Covers Chrome, Edge, Opera Neon, and Comet profile paths
let ExtensionPaths = dynamic([
    "\\AppData\\Local\\Google\\Chrome\\User Data\\",
    "\\AppData\\Local\\Microsoft\\Edge\\User Data\\",
    "\\AppData\\Roaming\\Opera Software\\",
    "\\AppData\\Local\\Comet\\User Data\\"
]);
let KnownGoodExtensions = externaldata(ExtensionId:string)[@"https://your-storage/known-good-extension-ids.csv"] with (format="csv");
DeviceFileEvents
| where TimeGenerated > ago(14d)
| where FileName =~ "manifest.json"
| where FolderPath has_any (ExtensionPaths)
| where FolderPath has "\\Extensions\\"
| extend ExtensionId = extract(@"\\Extensions\\([a-p]{32})\\", 1, FolderPath)
| where isnotempty(ExtensionId)
| summarize FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), Devices = dcount(DeviceName), DeviceList = make_set(DeviceName, 25) by ExtensionId, InitiatingProcessFileName
| where ExtensionId !in (KnownGoodExtensions)
| order by FirstSeen desc;

// Hunt: Chromium processes launched with extension sideloading or remote debugging flags
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where FileName in~ ("chrome.exe", "msedge.exe", "opera.exe", "neon.exe", "comet.exe")
| where ProcessCommandLine has_any ("--load-extension", "--disable-extensions-except", "--remote-debugging-port", "--remote-debugging-pipe")
| where ProcessCommandLine !has_any ("selenium", "puppeteer", "ms-playwright", "chromedriver")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by TimeGenerated desc;

// Hunt: Anomalous egress volume from browser processes to rare first-seen domains
// (AI-assistant-driven exfiltration inherits the browser's network stack)
let Lookback = 14d;
let Baseline = DeviceNetworkEvents
| where TimeGenerated > ago(30d) and TimeGenerated < ago(Lookback)
| where InitiatingProcessFileName in~ ("chrome.exe", "msedge.exe", "opera.exe", "neon.exe", "comet.exe")
| summarize by RemoteUrl;
DeviceNetworkEvents
| where TimeGenerated > ago(Lookback)
| where InitiatingProcessFileName in~ ("chrome.exe", "msedge.exe", "opera.exe", "neon.exe", "comet.exe")
| where RemoteUrl !in (Baseline)
| summarize Connections = count(), Devices = dcount(DeviceId), DeviceList = make_set(DeviceName, 15) by RemoteUrl, RemoteIP
| where Devices <= 3
| order by Connections desc;

-- Artifact: SecurityArsenal.Chromium.ExtensionInventory
-- Enumerate all installed Chromium extensions across Chrome, Edge, Opera, and Comet profiles
-- and flag extensions with high-risk permission sets capable of driving embedded AI assistants.

LET profiles = SELECT FullPath AS ProfileDir,
      parse_string_with_regex(string=FullPath,
        regex="(?i)(Chrome|Edge|Opera Software|Comet)").g1 AS Browser
   FROM glob(globs=[
     "C:/Users/*/AppData/Local/Google/Chrome/User Data/*/Extensions/*/*/manifest.json",
     "C:/Users/*/AppData/Local/Microsoft/Edge/User Data/*/Extensions/*/*/manifest.json",
     "C:/Users/*/AppData/Roaming/Opera Software/*/Extensions/*/*/manifest.json",
     "C:/Users/*/AppData/Local/Comet/User Data/*/Extensions/*/*/manifest.json"
   ])

LET parsed = SELECT ProfileDir, Browser, FullPath,
      parse_json(filename=FullPath) AS Manifest
   FROM profiles

SELECT Browser,
       FullPath AS ManifestPath,
       Manifest.name AS ExtensionName,
       Manifest.version AS Version,
       Manifest.permissions AS Permissions,
       Manifest.host_permissions AS HostPermissions,
       timestamp(epoch=stat(filename=FullPath).Mtime) AS ManifestModified
FROM parsed
WHERE Permissions =~ "(?i)(tabs|activeTab|scripting|webRequest|cookies|nativeMessaging|<all_urls>)"
   OR HostPermissions =~ "(?i)(<all_urls>|\\*://\\*/)"

# SecurityArsenal - Chromium Extension Audit & AI-Assistant Exposure Assessment
# Run elevated for machine-wide coverage. Outputs CSV for SIEM ingestion.
# Tested: Windows 10/11, Chrome/Edge/Opera/Comet profiles

$ErrorActionPreference = 'SilentlyContinue'
$report = @()

$browserPaths = @{
    'Chrome'    = "$env:SystemDrive\Users\*\AppData\Local\Google\Chrome\User Data\*\Extensions"
    'Edge'      = "$env:SystemDrive\Users\*\AppData\Local\Microsoft\Edge\User Data\*\Extensions"
    'Opera'     = "$env:SystemDrive\Users\*\AppData\Roaming\Opera Software\*\Extensions"
    'Comet'     = "$env:SystemDrive\Users\*\AppData\Local\Comet\User Data\*\Extensions"
}

# High-risk permissions that enable AI-assistant manipulation or broad page access
$highRisk = @('tabs','activeTab','scripting','webRequest','webRequestBlocking','cookies','nativeMessaging','debugger','<all_urls>')

foreach ($browser in $browserPaths.Keys) {
    $extRoots = Get-Item $browserPaths[$browser]
    foreach ($root in $extRoots) {
        foreach ($extIdDir in Get-ChildItem $root.FullName -Directory) {
            $manifest = Get-ChildItem $extIdDir.FullName -Recurse -Filter manifest.json |
                        Sort-Object LastWriteTime -Descending | Select-Object -First 1
            if ($manifest) {
                try { $m = Get-Content $manifest.FullName -Raw | ConvertFrom-Json } catch { continue }
                $perms = @($m.permissions) + @($m.host_permissions)
                $riskHits = ($perms | Where-Object { $highRisk -contains $_ }) -join ';'
                $report += [PSCustomObject]@{
                    Browser        = $browser
                    ExtensionId    = $extIdDir.Name
                    Name           = ($m.name -replace '^__MSG_.*__$','<localized>')
                    Version        = $m.version
                    Profile        = $root.Parent.Parent.FullName
                    RiskyPerms     = $riskHits
                    RiskFlag       = [bool]$riskHits
                    ManifestPath   = $manifest.FullName
                    LastModified   = $manifest.LastWriteTime
                }
            }
        }
    }
}

# Check for force-installed extensions via policy (machine + user, both vendors)
$policyKeys = @(
    'HKLM:\SOFTWARE\Policies\Google\Chrome\ExtensionInstallForcelist',
    'HKCU:\SOFTWARE\Policies\Google\Chrome\ExtensionInstallForcelist',
    'HKLM:\SOFTWARE\Policies\Microsoft\Edge\ExtensionInstallForcelist',
    'HKCU:\SOFTWARE\Policies\Microsoft\Edge\ExtensionInstallForcelist'
)
foreach ($k in $policyKeys) {
    if (Test-Path $k) {
        Get-Item $k | Select-Object -ExpandProperty Property | ForEach-Object {
            $report += [PSCustomObject]@{
                Browser='Policy'; ExtensionId=(Get-ItemProperty $k).$_; Name='<force-installed via policy>'
                Version='-'; Profile=$k; RiskyPerms='POLICY-FORCED'; RiskFlag=$true
                ManifestPath='-'; LastModified=Get-Date
            }
        }
    }
}

$out = "$env:ProgramData\SecurityArsenal\ExtensionAudit_$(Get-Date -Format yyyyMMdd_HHmmss).csv"
New-Item (Split-Path $out) -ItemType Directory -Force | Out-Null
$report | Sort-Object RiskFlag -Descending | Export-Csv $out -NoTypeInformation
Write-Host "[+] $($report.Count) extensions enumerated. High-risk: $(($report | Where-Object RiskFlag).Count). Report: $out"