ChatGPT's Chrome Extension Can Now Read Your Open Tabs

The ChatGPT extension for Chrome can now pull information from your open tabs and bring the assistant into the browser sidebar, as The Verge reported on 15 October. That is a small sentence describing a large change in what the assistant can see.

A browser tab is not a document. It is an authenticated session, and the contents of the tabs a person has open at any moment are assembled from whatever they were doing: an inbox, a bank balance, an admin console, a patient record, a private repository, a support queue with customer data in it. Granting a model read access to that set is a different decision from pasting a page into a chat window, because pasting is deliberate and per-page, and this is ambient and wholesale.

What the extension gets aside from the page text

The obvious exposure is page content. The one that is easy to miss is what surrounds it. A page carries cookies and session state the extension does not need to read in order to act on the user's behalf, and a signed-in tab is a capability: if the assistant can operate the tab, it can exercise whatever that session is authorised to do. Reading a tab and acting on a tab are one step apart when the same agent holds both. The Verge's report describes the assistant pulling information from open tabs, with the researcher's note that it can act on them.

There is also the shape of the data flow to consider. Tab contents gathered by an extension and sent to a model are assembled somewhere, and that assembly point sees every page at once rather than one at a time. A user may be comfortable sending one document to a vendor and not comfortable with a single component that holds the combined contents of everything currently open. Adoption decisions should be made against the second description, not the first.

Prompt injection stops being a theoretical concern here

A reading agent turns every page it reads into instructions it might follow. Indirect prompt injection is the name for the failure where text on a page, in a comment, in an email or in a support ticket is written to be read by the model rather than by the person, and the model treats it as a command. The attack surface is not the user's own text; it is every page the agent loads while doing a job.

Academic work has measured this against web agents. AgentBreaker, a paper in the Proceedings of the ACM on Software Engineering from ISSTA 2026, studies context-aware indirect prompt injection against them. The research file for this story notes that the paper's results were not read during research, so treat it as a pointer to published work rather than as a settled measurement. What can be said without the numbers is that the class of attack is being formalised, which is the relevant fact for anyone deciding whether to hand an agent a logged-in browser.

The practical consequence is a change in what counts as a hostile input. A page that renders correctly and contains no script can still carry instructions, and the person reading it will never see them. Any workflow where an agent reads untrusted pages and then acts on a session that can spend money, send mail or change settings is a workflow with a confused-deputy problem in it.

Where the reporting is thin, and what is not confirmed

The rollout details are not established. The Verge's page date was not visible on fetch, the story was reported on 15 October and aggregator copies are dated 16 October, and the exact extension version, the availability by country and which account tiers get the tab-reading behaviour are all unconfirmed in the research. The primary listing for it is unchanged: OpenAI's release notes are the place those details appear, and the researcher could not load them.

A secondary detail circulates in the same reporting cycle, that the Chrome sidebar can now chat with ChatGPT directly rather than only with Codex. It was not read at the source during research, so treat it as reported rather than verified.

Why the browser is the harder case than an API

An agent given an API key has exactly the access that key grants, and an administrator can scope it, rotate it and revoke it without touching anything else. A browser session is the opposite of scoped. The same profile holds a work email, a cloud console, a payment method and whatever else the user signed into this morning, and none of those services issued a credential to the assistant. The assistant is borrowing the human's authenticated presence, which is why tab access is difficult to review in a permission dialog and difficult to reverse after a mistake.

Chrome's extension platform gives administrators some control here. Enterprise policy can govern which extensions install and what they are allowed to do, and Chrome 155 adds debugger and screenshot restrictions that enforce those policies. None of that answers the question the user has to answer first, which is whether they want the assistant reading the tabs at all.

What to check before you leave it installed

Start with the permissions the extension actually requests and the ones it can be granted at runtime. A tab-reading capability that is opt-in per site is a different risk from one that applies everywhere, and the settings page is where that distinction is visible.

Then separate the browser you use for work from the browser you use for a model. If the extension needs an authenticated profile to be useful, give it a profile that holds only the accounts you are willing to expose, rather than the one holding your email, cloud console and banking sessions. That is a five-minute change that removes most of the blast radius.

Finally, treat every untrusted page as an instruction channel. If a workflow has the agent read a page from the open internet and then act, the action should be one that a mistake can be undone from, and the account it acts with should hold no more privilege than the task needs. None of that is unique to this extension. It is the standard advice for agentic browsing, and it applies here because the extension has just made agentic browsing the default in the most widely installed browser.