Hidden API in Perplexity's Comet Browser Enables Device Takeover
Security researchers at SquareX reported discovering a hidden API in Perplexity's Comet browser that allows embedded extensions to execute arbitrary commands on users' devices without explicit consent or transparent documentation. Researchers demonstrated the vulnerability through an attack simulation and warned that compromise of Perplexity's infrastructure could grant attackers device-level control over all Comet users.
What happened
SquareX researchers discovered a hidden MCP API (chrome.perplexity.mcp.addStdioServer) in Perplexity's Comet browser that allows embedded extensions to execute arbitrary local commands and gain full control over users' devices.
The API is found in the Agentic extension and can be triggered by the perplexity.ai page, creating a covert channel to access local data and launch arbitrary commands without user consent. There is limited official documentation disclosing this capability or that embedded extensions have persistent access to the API.
SquareX demonstrated the vulnerability using extension stomping to disguise a malicious extension as the embedded Analytics Extension, which injected a script into perplexity.ai to invoke the Agentic Extension and execute WannaCry on a test device.
Reported impact
The hidden API represents a breach of user trust and bypasses decades of browser security principles that prevent browsers and extensions from directly controlling underlying devices. A compromise of Perplexity's infrastructure via XSS vulnerability, phishing attack, or insider threat would instantly grant attackers unprecedented control over every Comet user's device.
Index analysis
Traditional browsers like Chrome, Safari, and Firefox require native messaging APIs with explicit registry entries and user consent for any local system access. Comet has bypassed these safeguards by implementing an undocumented persistent API accessible to embedded extensions without user permission.
Governance controls
The MCP API implementation lacks transparency, with documentation covering only the feature's intent without disclosing that embedded extensions have persistent access and can launch local apps arbitrarily without user permission.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.