Published on September 20, 2026
BragJack attacks hijack AI browser agents through malicious extensions
Severity
High
Detail
Security researcher Gal Weizman of Forever Security has disclosed a proof-of-concept attack technique named BragJack that can hijack AI assistants integrated into Chromium-based browsers through a single malicious browser extension.
The technique was demonstrated against Google Chrome Gemini Live, Perplexity Comet, Microsoft Edge, Opera Neon, and Anthropic Claude in Chrome. The research resulted in more than $20,000 in bug-bounty rewards and two CVEs. Google and Microsoft have since addressed the vulnerabilities assigned to their products.
The attack requires the malicious extension to already be installed in the victim’s browser. Once installed, the extension can manipulate browser traffic and interact with privileged AI components, potentially allowing the attacker to access sensitive information or instruct the AI agent to perform actions on the victim’s behalf.
How?
BragJack abuses the trust relationship between browser extensions, web applications, and privileged AI browser components. The AI assistant effectively acts as the decision-making layer, while privileged browser components perform actions such as reading webpages, accessing tabs, taking screenshots, and interacting with websites.
The malicious extension abuses Chromium’s declarativeNetRequest (DNR) functionality to intercept and modify network requests. In the Chrome attack, the researcher used DNR rules to weaken security headers and redirect JavaScript resources, allowing code to execute within the Gemini context and communicate with Chrome’s privileged AI component. This could provide access to local files, web content, screenshots, and potentially the browser’s camera and microphone. Chrome assigned CVE-2026-0628 to the issue.
Against Perplexity Comet, the attack allowed the malicious extension to communicate with the browser’s built-in AI agent. The researcher demonstrated access to browsing history, screenshots, local files, and the ability to send instructions to the AI agent. The agent could then be forced to visit websites, summarize emails, and send the collected information to another address.
Microsoft Edge’s implementation was affected by a different issue involving a race condition between its “Think” and “Do” modes. The flaw could temporarily bypass the separation intended to prevent the AI agent from simultaneously processing instructions and performing actions. Microsoft assigned CVE-2026-55945 to the vulnerability.
Similar techniques were demonstrated against Opera Neon and Claude in Chrome. The researcher described the broader technique as Prompt Forcing, where malicious browser extensions effectively provide instructions directly to an AI agent rather than relying on conventional prompt injection through content the AI is reading. This can cause legitimate browser and AI components to perform actions using the victim’s existing privileges.
Recommendation
Organizations should implement a layered security approach to reduce the risk of BragJack and similar attacks:
- Keep browsers and AI browser agents fully updated with the latest security fixes.
- Remove unnecessary or untrusted browser extensions and restrict installation of extensions where possible.
- Review extensions requesting broad permissions such as “read and change all your data on all websites.”
- Monitor browser extensions for unexpected network requests, redirects, script injection, and access to sensitive information.
- Restrict AI browser agents from accessing sensitive files, credentials, corporate email, and privileged web applications unless required.
- Use endpoint security and browser-management policies to control unauthorized extension installation.
Source