Research
Vulnerability disclosures and technical notes from the team.
-
promptPrompt Forcing: The Scarier Sibling of Prompt Injection
Breaking down a newly discovered prompt attack technique that isn't prompt injection.
Read article -
securityBragJack: How We Hijacked 5 Of The World's Most Popular Browsers Using Their Built-In AI Assistants
We hijacked the agents inside Gemini Live in Chrome, Microsoft Edge, Opera Neon, Perplexity Comet, and Claude in Chrome - using one single extension
Read article -
securityBragJack [Technical Overview]: How We Hijacked Top 5 Browsers' Internal Agents With Just One Single Extension
BragJack attack (discovered by Forever Security) allowed ordinary extensions to hijack the internal browser agent of Comet, Chrome, Edge, Opera, and Claude in Chrome
Read article -
securityMaXSS & Spyder: How two Chrome extensions allow websites to compromise over 10 million browsers
How SiderAI and MaxAI agentic side panel extensions are vulnerable to severe cross-site vulnerabilities, allowing attackers to compromise browsers easily and entirely
Read article -
securitySpyder: Chrome Extension SiderAI Vulnerable to UXSG Puts 10,000,000 Users at Risk
How SiderAI Chrome extension vulnerability allowed arbitrary websites to hiddenly embed other websites and trigger typing/clicking gestures within them, effectively allowing UXSG (Universal Cross Site Gesturing)
Read article -
securityMaXSS: Chrome Extension MaxAI Vulnerable to UXSS Puts 1,000,000 Users at Risk
How MaxiAI Chrome extension vulnerability allows arbitrary websites access extension-level permissions, leading to UXSS, arbitrary local file read (potentially), universal screenshooting, and more
Read article