Chrome Extension Sidepanel Agent Lacks User Confirmation for Tool Execution

Vulnerability Summary Overview This vulnerability involves the Chrome extension sidepanel agent lacking a user confirmation step when executing automated tool calls for model requests. Attackers can control page content or summary instructions to induce the agent to perform privileged browser automation operations (such as navigation or debugger actions) without end-user approval. Impact CVSS Score: 8.1 (High) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N Impact: Attackers can leverage model output content to induce the agent to execute unauthorized browser automation operations, affecting confidentiality and integrity. Remediation 1. Add User Confirmation Step: Insert an explicit user confirmation step before each automated tool execution. 2. Return Cancellation Message: When the user rejects a tool call, return a tool result cancellation message, allowing the agent to proceed with non-privileged browser automation. 3. Regression Testing: Add regression tests to ensure that rejected automated tool calls are not executed when confirmation is not connected. Code Blocks Pre-fix Code Post-fix Code Regression Test Code Additional Information Fixed Files: - - - CVSS Assessment: - Issue: Unconfirmed model request for browser automation - CVSS v3.1: 8.1 High - Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N Security Reproduction Steps: 1. Run the added regression tests on the vulnerable code. 2. Tests fail because is never called, and the loop lacks a rejection path. 3. Apply the patch. 4. Re-run the same test, observing that rejected tool calls are converted into error tool result messages, and is not invoked. Expected Vulnerable Behavior: - Pre-patch, automated tool calls returned by the model are executed directly when automation is enabled. - There is no per-call user-visible prompt, nor a rejection path before . Changes in this PR: - Added an optional hook to . - Check the hook before each automated tool call. - Attach a cancellation/error tool result when the user rejects the call. - Connect the Chrome extension sidepanel to with tool name and JSON parameters. - Add a focused security regression test for rejected automated tool calls. Maintainer Impact: - The patch is limited to sidepanel agent automation and does not change non-automated summarization behavior. - The core loop hook is optional, preserving existing tests and websites that do not invoke the confirmation callback. - Operators/users intentionally using automation can still approve expected tool calls, but unexpected page-impacting calls will now stop at a visible prompt. Rationale: - The most secure persistent boundary is the final point before model-requested actions become privileged browser automation. - Broad automation-enable settings are useful but should not be construed as approval for every future tool call. - Per-call confirmation keeps the default path auditable while preserving advanced automation workflows. Change Types: - Security Fix - Testing - Documentation Update - Refactoring with no behavioral changes Test Plan: - Reproduce the missing confirmation path using the new regression test before implementing the fix. - Verified locally running on Node v22.22.2; printed a Node engine warning (>=24) for the repository. The above commands still completed successfully. Token Usage: - Discovery Token: Partially Unknown - Validation Token: Partially Unknown - Deduplication Check Token: Partially Unknown - PR/Write Token: Partially Unknown - Total Tokens: Partially Unknown - Note: Precise telemetry was not available during this local patching session. Disclosure Notes: - This PR is limited to the Chrome extension sidepanel agent automation execution boundary. - It does not claim to bypass browser extension permissions or achieve unauthorized code execution. - Open PR/issue checks found no existing duplicates for this per-call automation confirmation form. Nearby security PRs address other extension trust boundaries, but this patch resolves a different execution gateway. - No irrelevant files were modified.

Goal Reached Thanks to every supporter — we hit 100%!

Chrome Extension Sidepanel Agent Lacks User Confirmation for Tool Execution

More from this source