Fast Facts

• Researchers found an undocumented API in Comet AI Browser that lets extensions take full control of users’ devices.
• The API, called MCP, allows embedded extensions to run local commands without user consent.
• Critical extensions are hidden from users, making it impossible to disable them-even if compromised.
• Security experts warn this flaw could allow hackers to launch ransomware or steal data with a single browser exploit.
• SquareX, the security firm that discovered the issue, is calling for industry-wide reforms and transparency.

The Browser Becomes the Trojan Horse

Imagine your web browser as the sturdy front door to your digital life: a trusted barrier, always locked tight. Now, picture a secret passage that lets strangers slip in and roam your house unchecked. That’s the chilling scenario unfolding in the Comet AI Browser, where researchers have uncovered an undocumented API that quietly hands the keys to the kingdom to embedded browser extensions.

Breaking Decades of Security Traditions

For years, browsers like Chrome, Firefox, and Safari have fiercely protected the boundary between the web and your device. Extensions-those handy browser add-ons-could never run wild on your computer. If they needed deeper access, they had to ask your explicit permission, jump through registry hoops, and submit to security vetting. Comet’s secret MCP API rewrites those rules, allowing certain extensions to execute any command on your device-silently, and with no way for users to intervene.

Security firm SquareX sounded the alarm after discovering that Comet’s Agentic extension, triggered from the perplexity.ai website, could exploit this hidden channel. In a demonstration, SquareX showed how a disguised malicious extension could use the API to unleash ransomware-like WannaCry-on an unsuspecting victim’s device. The implications are stark: a single successful phishing attack or browser exploit could give attackers godlike control over every Comet user’s system.

Lessons (Un)Learned: Echoes of Past Breaches

This isn’t the first time browsers have faced scandals over hidden or overreaching features. The infamous Superfish incident on Lenovo laptops, where pre-installed software exposed users to hijacking, comes to mind. But unlike past debacles, Comet’s vulnerability is stealthier-because its embedded extensions are invisible to users and security teams. No dashboard, no disable switch, and scant official documentation.

The rush to dominate the emerging “AI browser” market is fueling a dangerous shortcut culture. In their quest to make browsers smarter and more powerful, vendors risk forgetting the hard-won lessons of the past: transparency, consent, and clear boundaries between the web and the device are non-negotiable.

Industry at a Crossroads

SquareX’s findings are a wake-up call for the entire browser industry. If left unchecked, these hidden APIs could become the norm, creating unseen backdoors for hackers and undermining user trust. Security experts are demanding mandatory disclosures, independent audits, and user controls for all embedded browser features-before the next breach makes headlines.

WIKICROOK

• API (Application Programming Interface): An API is a set of rules that lets different software systems communicate, acting as a bridge between apps. APIs are common cybersecurity targets.
• Extension: An extension is a small program that adds new features or functions to a web browser, enhancing its capabilities and user experience.
• Ransomware: Ransomware is malicious software that encrypts or locks data, demanding payment from victims to restore access to their files or systems.
• XSS (Cross: XSS (Cross-Site Scripting) is a web security flaw where attackers inject harmful scripts into trusted sites, risking user data and privacy.
• Native Messaging: Native Messaging lets browser extensions securely interact with local applications, usually with user consent, to enable advanced features and integrations.