# Is Comet Browser Safe? 2025 Prompt-Injection Findings (2026)

> Brave's 2025 disclosure shows Comet runs hidden page instructions as your commands. What it proved, what it did not, and a keep-or-not decision table.

- Canonical: https://www.superchargebrowser.com/library/is-comet-browser-safe-2026/
- Published: 2026-09-04
- Updated: 2026-09-04
- Source: SuperchargeBrowser (https://www.superchargebrowser.com)

You're logged into your work email, Comet's agent reads the page, and a hidden instruction in the HTML tells it to click a button you never asked for. That is the risk class Brave documented on 2025-08-20: prompt injection, where page content becomes a command the agent executes. It is a different problem from data sharing.

> **Key takeaways**
> - Brave's 2025-08-20 disclosure showed Comet's agent can execute hidden page instructions as user commands. That is a prompt-injection risk class, distinct from data sharing.
> - LayerX demonstrated a one-click session hijack ("CometJacking") and claims Comet is 85% more phishing-vulnerable than Chrome. That figure is LayerX's, not an independent benchmark.
> - If your banking, email, or work logins run in a browser where an agent acts on page content, the exposure grows with every session. Keep those in plain Chrome and use workspaces plus fast tab search for the organizational work.

## Verdict: Fine for Research, Risky Where Your Login Lives

For casual, throwaway browsing, Comet works and the documented findings do not make it dangerous in a way you will hit on a Tuesday afternoon. The problem starts the moment your session carries value: a bank transfer, a work email with a client attachment, a login you do not want to re-type. In those sessions, an agent that reads page content and acts on it is a surface you cannot see, and the 2025-08-20 disclosure showed that surface is exploitable.

If you use Comet the way most people do for research (open a tab, ask the agent to summarize, close it), the documented risk is low. If you log into your bank in the same browser where the agent is active, a hidden instruction or a malicious URL can reach that session. The sessions where a hijack has something to grab are the ones that need a different setup.

## What Brave's 2025-08-20 Disclosure Actually Showed

The disclosure, published by Brave on 2025-08-20 (12 months before this article's September 2026 publication), described a specific attack path:

- A malicious or compromised page embeds hidden instructions in its HTML or rendered content.
- Comet's agent, which reads the page to generate summaries or take actions, encounters those instructions.
- The agent treats the hidden text as a legitimate user command and executes it.
- The result: the agent performs an action (navigate, click, copy data) that the user never explicitly requested.

Brave framed this as an indirect prompt-injection vulnerability. Page content becomes an input channel to the agent, and because the agent has permissions to act on your behalf, that input channel is a command channel. The mitigation described was to treat all page-derived content as untrusted input, not as instructions.

**What it did not show:**

- It did not show that Comet transmits your browsing history, bookmarks, or local files to a third party. That is a data-sharing question, covered in a different article.
- It did not show that every page you visit will exploit the vulnerability. The attack requires a specific malicious payload.
- It did not establish whether the vulnerability is patched in the current build. The disclosure is from August 2025, and patch status is outside its scope.

The 2025-08-20 Brave disclosure identified an indirect prompt-injection path in Comet's agent. Hidden page instructions can be executed as user commands. The risk class is command injection, not data exfiltration.

## LayerX and Guardio: The Phishing Layer on Top

The Brave disclosure covered the agent-execution path. Two separate findings add a phishing dimension on top.

**LayerX** published a finding they call "CometJacking." Their demo: a malicious URL, when opened in Comet, gives an attacker a one-click foothold in the user's active session. They also claim Comet is 85% more phishing-vulnerable than Chrome. That 85% figure is LayerX's measurement and framing.

**Guardio Labs** published a phishing demo they call "Agentic Blabbering" (covered by Tom's Hardware). The demo shows the agent being talked into navigating to a phishing URL through social-engineering dialogue, without any hidden page injection. The agent's willingness to follow conversational instructions becomes the attack vector.

Together, the three findings (Brave, LayerX, Guardio) describe a browser where the agent's ability to act on content is both the feature and the risk surface. The mitigation across all three is the same: do not give the agent a session that matters.

## Keep It or Drop It: What Your Usage Decides

| What you do in the browser | Risk level with Comet's agent active | Recommendation |
|---|---|---|
| Throwaway research, reading, summarizing | Low. No high-value session to hijack. | Fine to keep the agent active. |
| Shopping, social media, casual browsing | Low-moderate. A phishing click is possible but you are not in a financial session. | Keep it, but do not enter payment details in a tab where the agent is active. |
| Email, banking, work logins | High. A session-hijack surface (LayerX's CometJacking) or a prompt-injection payload (Brave's finding) can compromise the login. | Run these in plain Chrome. Use workspaces and fast tab search for the organizational value without the agent. |
| Development, internal tools, admin panels | High. Credential exposure plus an agent that can act on page content. | Plain Chrome. No agent on tabs that carry credentials. |

## The Chrome Fallback: Same Tab Organization, No Agent

The reason to reach for an agentic browser is usually two things: keeping work and personal tabs in separate groups, and finding the tab you need without scrolling through 40 favicons. Both are available in plain Chrome with no agent layer.

| What you get from Comet's agent | Reproducible in plain Chrome + SuperchargeNavigation? | Notes |
|---|---|---|
| Separate work and personal tab groups | Yes. Workspaces, synced across devices, ON by default for fresh installs. | SuperchargeNavigation is a Manifest V3 extension, CWS version 1.3.4 as of 2026-09-04. |
| Fast search across all open tabs | Yes. Quick-search shortcut (Alt+K by default, rebindable). | |
| Agent summarizes a page for you | No. This is the capability you give up. | |
| Agent navigates or clicks on your behalf | No. This is the capability you give up. | |



What you trade is explicit: summarization and auto-navigation out, a browser where no agent reads your page content in. For the two organizational tasks, the fallback is complete.

## The Call, By Session Type

If your important sessions (email, banking, work logins, admin panels) run in the same browser where an agent reads page content, move those sessions to plain Chrome. Add SuperchargeNavigation for the workspace and tab-search work that made you reach for Comet in the first place.

If you only open Comet for throwaway research (a quick summarize, a reading tab, a reference lookup), the documented exposure is lower. You are not sitting in a login session that a hijack would touch. The risk is still nonzero. A phishing demo exists. Weigh it against the convenience, but it is not the same order of problem.

In both cases, the decision is per session, not per browser. You can keep Comet installed and turn the agent off for the tabs that matter, or you can run plain Chrome with the extension and never install it.

---

Canonical URL: https://www.superchargebrowser.com/library/is-comet-browser-safe-2026/