BragJack Turns Browser Extensions Into Control Channels for AI Agents

A proof-of-concept technique named BragJack shows how one malicious browser extension can hijack AI assistants connected to Chromium-based browsers. Researcher Gal Weizman of Forever Security demonstrated the approach against Google Chrome’s Gemini Live, Perplexity Comet, Microsoft Edge, Opera Neon, and Anthropic’s Claude in Chrome.

The extension must already be installed in the victim’s browser. From there, however, the demonstrated attacks could cross boundaries intended to separate ordinary extensions from privileged AI components.

Depending on the target, BragJack exposed local files, browser history, screenshots, web content, and agent instructions. In browsers whose assistants can operate websites, the technique also allowed the attacker to trigger actions on the victim’s behalf.

The five vendors paid more than $20,000 in bug bounties, with individual awards ranging from $600 to $7,000. Two findings received CVE identifiers, and Google and Microsoft reportedly resolved their assigned vulnerabilities.

Prompt Forcing Exploits the Agent’s Privileged “Body”

BragJack targets the connection between an AI model and the browser component responsible for carrying out its decisions.

The model interprets language and decides what to do. A more privileged browser-level component then performs operations such as reading tabs, accessing files, capturing screenshots, navigating websites, or interacting with page controls.

Weizman calls the exploitation method Prompt Forcing. It differs from conventional prompt injection, where hostile instructions are hidden inside content that an AI assistant happens to read.

With Prompt Forcing, the attacker supplies the agent with a complete prompt and follow-up commands. The compromised agent then uses legitimate browser interfaces to execute those instructions.

This distinction matters for detection. Instead of conventional malware directly opening files or sending browser commands, trusted software performs the operations through approved capabilities. Endpoint monitoring may therefore see a browser or AI component accessing resources it is technically authorized to reach.

All five demonstrations used Chromium’s declarativeNetRequest, commonly abbreviated as DNR. This extension capability can modify how network requests are processed, including changing response headers and redirecting resources.

The malicious extension used DNR to manipulate pages or traffic trusted by the AI component. Restrictions blocking direct access to protected browser pages were therefore insufficient: the extension altered resources before they reached the privileged context.

Gemini Live Compromise Reached Files and Screenshots

Chrome extensions could not directly access the privileged chrome://glic component or inject scripts into Google’s Gemini website. BragJack instead intercepted requests created by the embedded Gemini application.

The attack modified security headers and redirected a JavaScript resource. That allowed attacker-controlled code to execute inside the Gemini context and communicate directly with Chrome’s privileged AI component, bypassing the normal Gemini request path.

The reported capabilities included:

• Reading local files
• Accessing website content
• Taking screenshots
• Potentially reaching camera and microphone functions

Google assigned the vulnerability CVE-2026-0628 and awarded Weizman $7,000.

The vulnerability has a CVSS 3.1 score of 8.8, with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. That rating describes high potential impact across confidentiality, integrity, and availability.

Google reportedly fixed the assigned flaw. The precise affected and corrected Chrome versions have not been disclosed, and no product-specific workaround is available in the published details.

Comet Demonstration Converted Data Access Into Action

The Perplexity Comet demonstration went beyond collecting information. Comet includes an agent that can navigate and interact with websites, giving forced prompts a path to produce external actions.

The agent extension trusted several Perplexity domains. One testing domain did not receive the same protections as the main perplexity.ai site. By using DNR to remove a redirect, the malicious extension could load that domain and inject a content script able to communicate with Comet’s built-in agent.

The resulting access covered browsing history, screenshots, local files, and instructions sent directly to the assistant.

In the proof of concept, the attacker forced Comet to visit Perplexity, summarize the victim’s email, and send that summary to another email address. The agent completed the workflow using its legitimate website-access capabilities.

This illustrates the additional exposure created by agentic browsers. An assistant that only summarizes visible content presents one class of risk; an assistant that can click, compose, navigate, and transmit data can turn a forced prompt into a completed operation.

Affected Comet versions have not been disclosed. No CVE, fixed version, or product-specific workaround is identified for this finding.

Edge Race Condition Bypassed the Think/Do Separation

Microsoft Edge separated its agent into “Think” and “Do” modes. The design was intended to prevent the assistant from accepting arbitrary instructions while it was also permitted to execute actions.

Weizman found a race condition in that separation. The proof of concept temporarily disabled the restriction while forcing a prompt, then restored action capability before the agent checked its state.

Microsoft tracks the issue as CVE-2026-55945, an Edge information-disclosure vulnerability caused by concurrent operations using a shared resource without proper synchronization.

The Microsoft Security Response Center advisory gives it a Moderate maximum severity and a CVSS 3.1 base score of 4.2. Its vector is CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N; the temporal score is 3.7.

Microsoft’s assessment describes a local, high-complexity attack requiring low privileges. The vulnerability has low confidentiality and integrity impact, no availability impact, and changed scope.

There is a notable difference between the research demonstration and Microsoft’s exploitation conditions. The broader BragJack account characterizes the agent hijacking as operating without direct victim interaction. Microsoft’s CVSS vector also records UI:N, but its FAQ says successful exploitation requires deceptive or invisible form elements and two sequential taps by the user.

Both descriptions apply to their respective contexts: one documents the demonstrated agent-hijacking technique, while the other is Microsoft’s authoritative assessment of the specific Edge vulnerability.

Microsoft identifies the exposed data as file content. An attacker could view some sensitive information and modify disclosed information, but could not prevent the legitimate user from accessing the affected resource.

The official fix is listed in Edge version 150.0.4078.48, based on Chromium 150.0.7871.47, with the release date recorded as 07/03/2026. Microsoft said the vulnerability was not publicly disclosed or exploited when its advisory was originally published.

Opera Neon and Claude Extend the Risk Across AI Browsers

Related attacks were also demonstrated against Opera Neon and Claude in Chrome. The latter is an extension integrated with the browser rather than a standalone browser product.

The Claude finding follows other research into weak trust boundaries around browser-integrated assistants. One earlier weakness allowed built-in Claude workflows to run after synthetic clicks without confirming that a real person generated them. The relevant behavior reportedly remained reproducible eight releases later.

Another issue, called ClaudeBleed, involved Claude in Chrome trusting the claude.ai origin without verifying which script was controlling the extension.

No additional CVE identifiers are assigned to these Claude-related issues. Affected versions, patch levels, and specific mitigations for Opera Neon and Claude in Chrome have not been disclosed.

BragJack is not identified as active exploitation in the wild. No CISA Known Exploited Vulnerabilities listing or remediation deadline is provided for either CVE.

Google and Microsoft have nevertheless had several other vulnerabilities added to CISA’s KEV catalog during the past 90 days: CVE-2026-58704 on 2026-09-16, CVE-2026-87491 on 2026-09-09, CVE-2026-81963 and CVE-2026-85880 on 2026-09-08, CVE-2026-85046 on 2026-09-04, and CVE-2019-1068 on 2026-08-26.

Defenders Should Treat AI Assistants as Privileged Components

The immediate control point is the extension layer. BragJack requires a malicious extension to be present, so organizations should inventory installed extensions and remove anything unrecognized, unused, or unsupported.

Permissions deserve particular scrutiny. Extensions requesting the ability to “read and change all your data on all websites”, redirect resources, or modify network requests can affect far more than one page.

Defenders should take the following actions:

1. Update browsers and AI extensions. Edge users should verify deployment of 150.0.4078.48 or a later fixed release. Google’s assigned flaw is reportedly resolved, although the corrected Chrome version is not specified.
2. Restrict extension installation. Enterprise allowlists reduce exposure to extensions acquired through compromised accounts, deceptive distribution, or untrusted marketplaces.
3. Reduce unnecessary permissions. Broad access to every website should not remain enabled when an extension’s function does not require it.
4. Audit agent activity. Investigate unexpected file access, screenshots, browsing-history queries, website navigation, email summaries, outbound messages, or AI prompts the user does not recognize.
5. Review DNR-capable extensions. BragJack repeatedly used request modification and resource redirection to cross trust boundaries.
6. Separate sensitive data from agent access. Browser assistants able to reach local files, email, microphones, cameras, or authenticated websites should be managed as privileged software.

No universal network indicator or malicious extension identifier has been disclosed. Detection must therefore focus on extension inventory, permissions, unusual AI-agent workflows, and unexplained browser-driven data access.