/
← Voltar ao feed
high technology

Hacktron discloses one-click UXSS in Perplexity Comet via XSS on a perplexity.ai subdomain and externally_connectable abuse

1 fonte(s) · 1 atualização(ões) · publicado 23/11/2025 21:00 · coletado há 1 dia

Hacktron researchers disclosed a one-click universal XSS (UXSS) in Perplexity Comet, a Chromium-based AI browser with the Comet Assistant agent extension. The extension's manifest trusts the wildcard https://*.perplexity.ai/* in externally_connectable, so a single XSS on any perplexity.ai subdomain can reach privileged extension message handlers. The researchers found a reflected XSS on fellowship.perplexity.ai (logout returnTo parameter) and bypassed the Cloudflare WAF. They then used extension actions to read cross-origin and local data and to drive the agent to act on arbitrary pages. The PoC read Gmail content and changed a Perplexity username. Perplexity was notified through its security contact and reportedly patched the issue within a day. No in-the-wild exploitation is reported.

Technical Details

  • Root cause: the externally_connectable wildcard https://*.perplexity.ai/* lets any matching origin call chrome.runtime.sendMessage / connect on extension ID npclhjbddhklpbnacpjloidibaggcgon.
  • Initial foothold: reflected XSS via the returnTo=javascript: parameter on the fellowship.perplexity.ai/logout endpoint. A multi-line, string-concatenation payload bypassed the Cloudflare WAF.
  • RUN_IDLE_TEST: uses chrome.debugger.sendCommand with DOMSnapshot.captureSnapshot. It accepts file:// URIs and returns the serialized DOM (snapshotHtml, snapshotAxTree), exposing cross-origin and local file content.
  • CALL_TOOL: exposes methods such as OpenTab, GetContent, GetVisibleTabScreenshot, CloseTabs and GroupTabs. These were used to open and read pages such as Gmail.
  • startAgentFromPerplexity: reachable through onConnectExternal. It opens a websocket to Perplexity's backend and executes returned actions (clicks, etc.) in the page, so an attacker can open any URL and make the agent act on it.
  • Failed escalation: attempts to reach RCE through Chrome privileged pages and by installing a malicious high-privilege extension did not succeed.
  • Hacktron says it also found a related DOM-XSS-on-subdomain entry point in its earlier OpenAI Atlas disclosure.

Remediation

  • Perplexity has patched the issue; the article says the fix came within a day of the report.
  • Keep Comet updated.
  • Developers should avoid wildcard origins in externally_connectable and validate the sender in external message listeners.
  • Developers should also restrict dangerous actions such as file:// access and arbitrary tab reads.
  • Hacktron released free agents (hacktron --agent chrome_extension, hacktron --agent domxss) to detect similar patterns.

Linha do tempo

  1. hacktron.ai ↗ · pub. 23/11/2025 21:00 · coletado 19/10 18:03 primeiro registro

    Hacktron discloses one-click UXSS in Perplexity Comet via XSS on a perplexity.ai subdomain and externally_connectable abuse

    ler a análise desta fonte

    Hacktron researchers disclosed a one-click universal XSS (UXSS) in Perplexity Comet, a Chromium-based AI browser with the Comet Assistant agent extension. The extension's manifest trusts the wildcard https://*.perplexity.ai/* in externally_connectable, so a single XSS on any perplexity.ai subdomain can reach privileged extension message handlers. The researchers found a reflected XSS on fellowship.perplexity.ai (logout returnTo parameter) and bypassed the Cloudflare WAF. They then used extension actions to read cross-origin and local data and to drive the agent to act on arbitrary pages. The PoC read Gmail content and changed a Perplexity username. Perplexity was notified through its security contact and reportedly patched the issue within a day. No in-the-wild exploitation is reported.

    Technical Details

    • Root cause: the externally_connectable wildcard https://*.perplexity.ai/* lets any matching origin call chrome.runtime.sendMessage / connect on extension ID npclhjbddhklpbnacpjloidibaggcgon.
    • Initial foothold: reflected XSS via the returnTo=javascript: parameter on the fellowship.perplexity.ai/logout endpoint. A multi-line, string-concatenation payload bypassed the Cloudflare WAF.
    • RUN_IDLE_TEST: uses chrome.debugger.sendCommand with DOMSnapshot.captureSnapshot. It accepts file:// URIs and returns the serialized DOM (snapshotHtml, snapshotAxTree), exposing cross-origin and local file content.
    • CALL_TOOL: exposes methods such as OpenTab, GetContent, GetVisibleTabScreenshot, CloseTabs and GroupTabs. These were used to open and read pages such as Gmail.
    • startAgentFromPerplexity: reachable through onConnectExternal. It opens a websocket to Perplexity's backend and executes returned actions (clicks, etc.) in the page, so an attacker can open any URL and make the agent act on it.
    • Failed escalation: attempts to reach RCE through Chrome privileged pages and by installing a malicious high-privilege extension did not succeed.
    • Hacktron says it also found a related DOM-XSS-on-subdomain entry point in its earlier OpenAI Atlas disclosure.

    Remediation

    • Perplexity has patched the issue; the article says the fix came within a day of the report.
    • Keep Comet updated.
    • Developers should avoid wildcard origins in externally_connectable and validate the sender in external message listeners.
    • Developers should also restrict dangerous actions such as file:// access and arbitrary tab reads.
    • Hacktron released free agents (hacktron --agent chrome_extension, hacktron --agent domxss) to detect similar patterns.