Varonis Details Attack Surfaces in Agentic LLM Browsers
Summary
Varonis Threat Labs analyzes agentic-browser architectures and reports how trusted-origin flaws could expose privileged browser tools. Tests also examined defenses against URL-triggered agent actions and prompt injection.
Key points
- The analysis compares Comet, OpenAI Atlas, Edge Copilot, and Brave Leo, whose different architectures create distinct security boundaries and attack surfaces.
- Comet’s force-installed extensions use an externally_connectable allowlist and privileged browser APIs; the researchers say script execution on a trusted origin could expose those tools.
- The article describes Atlas’s Mojo IPC bridge and Edge Copilot’s postMessage interface as paths to privileged browser functions when an authorized context is compromised.
- In an Edge Copilot test, researchers used a tool to repeatedly capture page content, including material in a private repository, and send it to an attacker-controlled server.
- In a test, Comet’s local_search_enabled control disabled agent tools for a prompt supplied through a q= URL parameter.
- The researchers describe potential abuse including unauthorized navigation, page scraping, local-file or internal-network access, and actions performed through the user’s browser authority.
- A prompt embedded in a page title influenced agent behavior during research; the article says this method was fixed by an update.
Article Details
- Attack Vectors
- XSS on a whitelisted origin can let attacker-controlled JavaScript call Comet's chrome.runtime.sendMessage bridge; similar trusted-origin paths are described for Atlas's Mojo interface and Edge Copilot's postMessage bridge.
- DNS spoofing, subdomain takeover, or RCE affecting a trusted origin are described as potential ways to reach high-privilege browser interfaces.
- The researchers report that page-title prompt injection influenced an agent's behavior; the article also discusses indirect prompt injection and system-prompt extraction.
- A data-void site loaded by an agent's GetContent tool may render active page content and could be used to induce unauthorized actions such as file downloads.
- The article describes potential agent-enabled scraping of other open tabs, access to local file URIs or internal network resources, and unauthorized emails, transactions, or downloads.
- Agentic CSRF through a q= URL parameter or external referrer is discussed as a potential trigger for unauthorized tool use; the article reports that Comet's control blocked tool execution in its test.
- Defensive Notes
- Comet disables local_search_enabled for requests originating from an external referrer or q= URL parameter, restricting the assistant to passive mode; the researchers report this worked in their test.
- Edge validates incoming postMessage origins against an allow-list and limits the privileged page to specifically bound Mojo interfaces.
- The article says Brave's locally loaded Leo interface neutralizes remote XSS attacks against the browser UI.
- The page-title prompt-injection method was fixed through an update during the research.
- The article recommends data-aware detection, including monitoring unexpected sensitive-data access, anomalous file reads, unusual outbound connections, and actions performed with user privileges without legitimate intent.
MITRE ATT&CK
T1005 · Data from Local SystemThe article says an agent could be induced to navigate to a local file URI such as file:///C:/passwords.txt and retrieve data from disk; this is described as a potential capability.T1059.007 · JavaScriptIn the described Comet attack path, JavaScript running on a whitelisted origin calls chrome.runtime.sendMessage to issue commands to the privileged extension.T1190 · Exploit Public-Facing ApplicationThe article describes XSS or other vulnerabilities on whitelisted domains as potential ways to execute attacker-controlled code and reach privileged browser bridges; it does not report an in-the-wild incident.T1213.003 · Code RepositoriesIn an Edge Copilot simulation, the researchers used Edge.Context.GetDocumentBody to capture sensitive content from a private GitHub repository and send it to an attacker-controlled server.T1557 · Adversary-in-the-MiddleIn a simulation, the researchers describe spoofing/AiTM-ing the Copilot domain, then using that trusted-origin context to send commands to the privileged Edge page.
People
Vendors
Braveinjection) across implementations such as Comet (Perplexity), OpenAI Atlas, Microsoft Edge Copilot, and Brave Leo.Microsoftand indirect prompt injection) across implementations such as Comet (Perplexity), OpenAI Atlas, Microsoft Edge Copilot, and Brave Leo.OpenAIdata-voids, and indirect prompt injection) across implementations such as Comet (Perplexity), OpenAI Atlas, Microsoft Edge Copilot, and Brave Leo.Perplexitybridge compromises, data-voids, and indirect prompt injection) across implementations such as Comet (Perplexity), OpenAI Atlas, Microsoft Edge Copilot, and Brave Leo.
Products
Atlasdata-voids, and indirect prompt injection) across implementations such as Comet (Perplexity), OpenAI Atlas, Microsoft Edge Copilot, and Brave Leo.Brave Leo AIBrave Leo AI: Integrated directly into the Chromium-based Brave browser.CometIPC/Mojo bridge compromises, data-voids, and indirect prompt injection) across implementations such as Comet (Perplexity), OpenAI Atlas, Microsoft Edge Copilot, and Brave Leo.Edge Copilotindirect prompt injection) across implementations such as Comet (Perplexity), OpenAI Atlas, Microsoft Edge Copilot, and Brave Leo.Microsoft Edgeand indirect prompt injection) across implementations such as Comet (Perplexity), OpenAI Atlas, Microsoft Edge Copilot, and Brave Leo.