BragJack attack hijacks AI browser agents via extensions

A single malicious browser extension can hijack the AI browser agents built into several popular Chromium-based browsers, a technique the researcher Gal Weizman of Forever Security calls BragJack. The proof of concept was demonstrated against five Chromium-based browsers or browser assistants: Google Chrome's Gemini Live, Perplexity Comet, Microsoft Edge, Opera Neon, and Anthropic's Claude in Chrome. Chromium is the open-source browser engine that Chrome, Edge, Opera and several other browsers are built on, and a browser extension is a small add-on that a user installs to add extra features. The research earned more than $20,000 in bug bounties from the five vendors, with rewards ranging from $600 to $7,000, and produced two CVE identifiers. A CVE is a public reference number given to a known security flaw so that vendors, defenders and the public can refer to the same issue.

One condition matters more than any other, and Weizman states it clearly: the attack requires the malicious extension to already be installed in the victim's browser. It is not a way to break into a clean browser from nothing. But once such an extension is present, the researcher showed the abuse can run without any user interaction, letting that extension take control of an AI browser agent and use the agent's existing privileges to reach sensitive information or act on the victim's behalf. Both Google and Microsoft have since resolved the flaws they were assigned.

The attacks exploit the way AI assistants are increasingly wired into browsers and handed browser-level capabilities. In his writeup, Weizman describes these systems as having a brain and a body. The AI model is the brain: it processes instructions and decides what should happen. A privileged browser component is the body: it performs the actions, such as accessing tabs, reading page content, taking screenshots, or interacting with websites. The problem, according to the researcher, is that browser extensions can manipulate the web traffic and the pages that these privileged components trust. The same extension worked against all five targets, relying on a Chromium feature called declarativeNetRequest, or DNR. DNR lets an extension influence how network requests are handled, including changing response headers (the small pieces of information a web server sends alongside a page) and redirecting resources to somewhere else.

In the Chrome case, Weizman found that extensions were blocked from directly touching the privileged chrome://glic component and from injecting scripts into Google's Gemini site, yet DNR rules could still intercept requests made by the embedded Gemini web app. By weakening security headers and redirecting a JavaScript resource, he executed code inside the Gemini context, which let him communicate directly with Chrome's privileged AI component instead of going through Gemini's normal request flow. According to the writeup, the resulting access could read local files, reach web content, take screenshots, and potentially reach the browser's camera and microphone. Chrome assigned the finding CVE-2026-0628 and paid a $7,000 bounty.

The attacks against agentic browsers such as Perplexity Comet and Opera Neon go further, because their agents can act on websites rather than merely read them. In the Comet case, Weizman found that the browser's built-in agent extension trusted several Perplexity domains, including a testing domain that did not receive the same protections as the primary perplexity.ai site. By removing a redirect to that domain with DNR, he loaded it and injected a content script, which is code an extension inserts into a page, that was able to talk to the built-in agent. The access this produced included browsing history, screenshots, local files, and the ability to send instructions to the agent. Weizman demonstrated forcing the agent to visit Perplexity, summarize the victim's emails, and send the results to another address.

Microsoft Edge presented a different challenge. Microsoft had split its agent into Think and Do modes, a design intended to stop the agent from accepting arbitrary instructions and taking actions at the same time. Weizman found a race condition, a timing flaw in which two operations overlap so that a check happens at the wrong moment, that briefly disables the restriction while a prompt is being forced and then re-enables the action capability before the agent checks its state. Microsoft assigned CVE-2026-55945 to the race condition. Similar flaws were demonstrated against Opera Neon and Claude in Chrome, although the latter is itself a browser extension rather than a browser.

Weizman calls the technique used to seize these agents Prompt Forcing. It differs from conventional prompt injection, where an attacker tries to slip malicious instructions into content that an AI is already reading. With Prompt Forcing, the attacker hands the agent an entire prompt along with follow-up instructions, and the agent then translates those instructions into legitimate browser actions using the privileges it already has. That distinction matters for endpoint defenses, the researcher argues, because the final action is not carried out by conventional malicious code. Legitimate software is being told to perform the attack. Ax Sharma, who reported the research, notes that earlier this year, in his own work at Manifold Security, he reported a related weakness in Claude for Chrome, where the extension ran its built-in AI workflows on synthetic clicks without verifying that they came from a real user, and the flagged code was still reproducible eight releases later. That followed ClaudeBleed, an earlier flaw in the same extension that LayerX disclosed in April, in which Claude for Chrome trusted the claude.ai origin rather than checking which script was actually driving it.

BragJack points to a growing challenge as browsers and other endpoint apps gain more capable AI agents. A compromised extension that would traditionally see only web content can, in some designs, become a path to software that reads files, browsing data, and acts on websites for the user. Weizman has published a full technical breakdown covering all five attacks in addition to his writeup, which is where the detailed mechanics can be reviewed. For users, the practical advice from the research is straightforward: keep browsers fully updated, remove extensions you do not recognize or no longer use, and treat broad requests to read and change all your data on all websites with caution. For organisations that want outside help reviewing what software is allowed to run in staff browsers and on their workstations, AEU-I provides security-first IT, infrastructure and consulting.