BragJack: One Extension Hijacks AI Agents in Browsers

Gal Weizman, a researcher at Forever Security, has disclosed an attack technique that lets a single malicious extension hijack the AI assistants built into browsers. The proof of concept, dubbed BragJack, was demonstrated against five Chromium-based products: Gemini Live in Google Chrome, Perplexity Comet, Microsoft Edge, Opera Neon and Anthropic's Claude in Chrome. The work earned its author more than $20,000 in bounties (ranging from $600 to $7,000 across the different vendors) and two CVE identifiers. Google and Microsoft have already patched the vulnerabilities assigned to them.

The "brain" and the "body"

Weizman describes AI browsers as a system of a "brain" and a "body": the model processes instructions and decides what to do, while a privileged browser component carries out the actions — opening tabs, reading content, taking screenshots, interacting with sites. The problem is that extensions can meddle with web traffic and pages that this privileged component trusts.

In all five cases the same extension was used, relying on Chromium's declarativeNetRequest (DNR) mechanism, which allows the handling of network requests to be altered, including response headers and resource redirection. In the attack on Chrome, direct access to the privileged component was blocked, but DNR rules intercepted the requests of the built-in Gemini web app. By weakening security headers and swapping out a JavaScript resource, the researcher executed code in Gemini's context and gained the ability to read local files, access web content, take screenshots and potentially reach the camera and microphone. Chrome assigned the finding CVE-2026-0628 and paid out $7,000.

From reading data to controlling the agent

Attacks on agentic browsers go further, since their assistants don't just read pages but also act on them. In Comet, Weizman found a Perplexity test domain that lacked the protections of the main site; by loading it, he injected a script and made the built-in agent log into the victim's email, compile a summary of the messages and send it to an outside address.

In Edge, where the agent was split into "Think" and "Do" modes, a race condition was discovered: the restriction is briefly disabled when a request is issued and re-enabled before the agent checks its state (CVE-2026-55945). Similar problems were demonstrated in Opera Neon and Claude in Chrome.

Prompt Forcing

The author calls his technique Prompt Forcing. Unlike the classic injection of instructions into readable content, here the attacker hands the agent an entire request with further directions, and the agent translates them into legitimate browser actions using its own privileges. The danger is that the final action is carried out not by malicious code but by legitimate software that was told to attack — ordinary endpoint protection tools don't notice this.

Users are advised to update their browsers promptly, remove unfamiliar and unused extensions, and be cautious about requests for permission to "read and change all your data on all websites."

Source: Bleeping Computer