A new attack technique, dubbed "BragJack" by its discoverer, security researcher Gal Weizman of Forever Security, can hijack AI assistants embedded in popular browsers using a single malicious browser extension. The proof-of-concept demonstrated the technique against five Chromium-based browsers or browser assistants: Google Chrome's Gemini Live, Perplexity Comet, Microsoft Edge, Opera Neon, and Anthropic's Claude in Chrome. The research led to over $20,000 in bug bounties and the assignment of two CVEs.
The BragJack attack requires a malicious extension to be already installed in the victim's browser. Once present, the attack can proceed without user interaction, allowing the extension to control an AI browser agent and leverage its existing privileges to access sensitive information or act on the victim's behalf. Both Google and Microsoft have since addressed the vulnerabilities.
The core of the attack exploits how AI assistants are integrated into browsers and granted extensive browser-level capabilities. Weizman describes these systems as having a "brain" (the AI model processing instructions) and a "body" (a privileged browser component performing actions like accessing tabs, reading content, taking screenshots, or interacting with websites). The vulnerability arises because browser extensions can manipulate web traffic and pages that these privileged components inherently trust.
The same malicious extension was used across all five targets, relying on Chromium's `declarativeNetRequest` (DNR) functionality. DNR allows extensions to modify network requests, including changing response headers and redirecting resources. In the attack against Chrome's Gemini, extensions were blocked from directly interacting with the privileged `chrome://glic` component or injecting scripts into Google's Gemini site. However, DNR rules could still intercept requests made by the embedded Gemini web application. By weakening security headers and redirecting a JavaScript resource, Weizman executed code within the Gemini context, establishing direct communication with Chrome's privileged AI component, bypassing Gemini's standard request flow. This access could potentially read local files, access web content, take screenshots, and potentially reach the browser's camera and microphone. Google assigned CVE-2026-0628 to this finding and awarded a $7,000 bounty.
Attacks against agentic browsers like Perplexity Comet and Opera Neon demonstrated even broader capabilities, as their agents are designed to act on websites rather than just read them. For Perplexity Comet, Weizman discovered that the browser's built-in agent extension trusted several Perplexity domains, including a testing domain that lacked the same protections as the primary `perplexity.ai` site. By using DNR to remove a redirect to this testing domain, he was able to load it and inject a content script capable of communicating with the built-in agent. This granted access to browsing history, screenshots, local files, and the ability to send instructions to the agent. Weizman demonstrated forcing the agent to visit Perplexity, summarize the victim's emails, and send the results to another address.
Microsoft Edge presented a different challenge, as its agent had separate "Think" and "Do" modes designed to prevent it from simultaneously taking arbitrary instructions and actions. Weizman identified a race condition that temporarily disabled this restriction while forcing a prompt, then re-enabled the action capability before the agent could verify its state. Microsoft assigned CVE-2026-55945 to this race condition. Similar vulnerabilities were demonstrated against Opera Neon and Anthropic's Claude in Chrome, though Claude itself operates as a browser extension rather than being built directly into the browser.
Weizman refers to this technique as "Prompt Forcing." Unlike conventional prompt injection, where an attacker attempts to embed malicious instructions within content an AI is already processing, Prompt Forcing allows the attacker to provide the agent with an entire prompt and subsequent instructions directly. The agent then translates these instructions into legitimate browser actions using its existing privileges. This distinction is significant for endpoint defenses, as the final malicious action is not executed by traditional malicious code but by legitimate software instructed to perform the attack.
The BragJack research highlights a growing security challenge as browsers and other endpoint applications integrate increasingly capable AI agents. A compromised extension, which would typically only access web content, can, in some architectural designs, become a conduit to software that can read files, access browsing data, and perform actions on websites on behalf of the user. Users are advised to keep their browsers fully updated, remove any extensions they do not recognize or no longer use, and exercise caution with broad "read and change all your data on all websites" permission prompts. Weizman has published a detailed technical breakdown of all five attacks.
