A security researcher has demonstrated how BragJack attacks can hijack AI assistants inside popular browsers. The technique uses a malicious extension to access sensitive data and make AI agents perform actions without further user interaction.
BragJack Affects Five AI Browser Tools
Gal Weizman, a security researcher at Forever Security, demonstrated the proof-of-concept attack against five Chromium-based products.
The affected tools included Google Chrome’s Gemini Live, Perplexity Comet, Microsoft Edge and Opera Neon. Weizman also tested Anthropic’s Claude in Chrome extension.
However, the attack requires the victim to install a malicious browser extension first. Once installed, the extension can launch the attack without any additional interaction.
The research produced two assigned vulnerabilities and earned more than $20,000 in bug bounties. Individual awards ranged from $600 to $7,000.
Google and Microsoft have since fixed the vulnerabilities reported in their products.
AI Assistants Gain Browser-Level Powers
Modern browsers increasingly connect AI models to privileged components that can interact with local and online content.
Weizman describes these systems as having a “brain” and a “body.” The AI model acts as the brain because it interprets instructions and decides what to do.
Meanwhile, a privileged browser component acts as the body. It carries out tasks such as reading tabs, accessing websites, taking screenshots and interacting with page elements.
Some AI browser agents can also reach local files and browsing histories. More advanced tools can perform actions on behalf of the user.
This structure creates a security problem. Browser extensions can modify web pages and network traffic that privileged AI components may trust.
Therefore, a malicious extension can potentially use the AI assistant as a bridge to more sensitive browser functions.
Malicious Extension Manipulates Network Requests
The researcher used the same extension across all five targeted products.
His attacks relied on Chromium’s declarativeNetRequest feature, also known as DNR. This system allows extensions to control how the browser handles network requests.
For example, an extension can redirect online resources or modify response headers. Legitimate extensions often use these capabilities for content filtering and privacy features.
However, the BragJack attacks show how threat actors could exploit the same functions.
A malicious extension can manipulate requests made by trusted AI interfaces. As a result, it may execute code in a privileged context that extensions normally cannot access.
Chrome Attack Targets Gemini Component
Chrome prevented extensions from directly modifying the privileged chrome://glic component. It also blocked script injection into Google’s Gemini website.
However, Weizman found that DNR rules could still intercept requests from the embedded Gemini web application.
The researcher weakened security headers and redirected a JavaScript resource. Consequently, he could run code within Gemini’s trusted context.
This access allowed the malicious extension to communicate directly with Chrome’s privileged AI component. It did not need to follow Gemini’s standard request process.
According to Weizman, the access could expose local files, website content and screenshots. It could also potentially reach the browser’s camera and microphone.
Chrome tracked the vulnerability as CVE-2026-0628. Google awarded the researcher a $7,000 bounty for the finding.
Agentic Browsers Create Greater Risks
Some AI browsers can perform tasks instead of only reading and summarising information.
For example, agents in Perplexity Comet and Opera Neon can navigate websites and interact with online services. Therefore, attackers who seize these agents may gain powerful capabilities.
Weizman found that Comet’s built-in agent extension trusted several Perplexity domains. However, one testing domain lacked the same protections as the main website.
The researcher used DNR to prevent the browser from redirecting away from that domain. He then injected a content script that could communicate with the built-in agent.
The resulting access exposed browsing history, screenshots and local files. Moreover, the researcher could send direct instructions to the agent.
In one demonstration, he forced the AI to open Perplexity and summarise the victim’s emails. The agent then sent that summary to another email address.
Race Condition Bypasses Edge Protections
Microsoft Edge divided its AI agent into two separate states called “Think” and “Do.”
This design aimed to stop the assistant from accepting arbitrary instructions while it could perform actions. However, Weizman discovered a race condition in the protection.
First, the attack briefly disabled the restriction and forced a prompt into the agent. It then restored the agent’s action capability before the system checked its state.
As a result, the agent could execute the injected instructions.
Microsoft assigned CVE-2026-55945 to the race condition. The company has since addressed the issue.
Weizman also demonstrated similar techniques against Opera Neon and Claude in Chrome. However, Claude in Chrome operates as a browser extension rather than a complete browser.
Prompt Forcing Controls the Entire Agent
Weizman calls the technique behind the BragJack attacks “Prompt Forcing.”
The method differs from conventional prompt injection. In a typical prompt-injection attack, hidden instructions appear inside content that an AI assistant reads.
Prompt Forcing instead gives the agent a complete prompt and subsequent instructions. The compromised assistant then converts them into legitimate browser actions.
This distinction creates challenges for endpoint security tools. Traditional malware normally performs suspicious actions through malicious processes or scripts.
In this case, legitimate software carries out the attack. The AI browser agent uses its existing permissions to follow the attacker’s commands.
Consequently, security software may struggle to distinguish malicious activity from an ordinary AI-assisted task.
Earlier Claude Flaws Raised Similar Concerns
Researchers have previously identified comparable weaknesses in Claude for Chrome.
One reported issue allowed synthetic mouse clicks to activate built-in AI workflows. The extension did not adequately confirm whether a real user had generated those clicks.
The researcher who disclosed that weakness said the behaviour remained reproducible across eight subsequent releases.
Another vulnerability, known as ClaudeBleed, appeared earlier in 2026. In that case, the extension trusted the claude.ai origin without checking which script controlled it.
These findings highlight a broader trust problem. AI browser tools may validate the website or interface while failing to verify the source of each instruction.
Users Should Review Browser Extensions
BragJack demonstrates how a single compromised extension can create a path to highly privileged AI software.
An ordinary malicious extension may initially gain access only to website content. However, a connected AI agent could expand that reach to files, browsing records and online accounts.
Users should install browser updates as soon as vendors release them. Updates may contain fixes for flaws affecting both extensions and built-in AI features.
They should also remove extensions they no longer recognise or use. Furthermore, users should carefully examine permission requests before approving an installation.
Extensions that request permission to read and modify data across every website require particular caution.
Ultimately, BragJack attacks show that AI browser agents can amplify existing extension risks. As these assistants gain more control, browsers must verify both what the agent does and who supplied its instructions.
0 responses to “BragJack Attacks Hijack AI Browser Agents Through Extensions”