Malicious Browser Extension MAIN World Injection on ChatGPT

Elgonad .@elgonad

•updated Jan 29, 2026•1•0•51

Detects the creation or modification of a browser extension's manifest.json file configured to inject a script into the 'MAIN' world context of chatgpt.com. This technique allows the extension to bypass the isolated content script environment, hook native APIs like window.fetch, and steal session tokens, as seen in a campaign targeting ChatGPT users.