Security researcher Gal Weizman of Forever Security has disclosed BragJack, a proof-of-concept attack that let a single malicious browser extension hijack the built-in AI agents in five major browsers: Google Chrome (Gemini Live), Microsoft Edge, Opera Neon, Perplexity Comet, and Claude in Chrome. The research earned Weizman more than $20,000 in combined bug bounties and produced two CVEs.
What Is BragJack
BragJack isn't a jailbreak, and Weizman didn't need to bypass any model's guardrails to pull it off. Instead, it exploits how "agentic" browsers are architected: each AI assistant is effectively split into a body (a privileged browser component that can screenshot tabs, read files, or trigger the camera and microphone) and a brain (the vendor's web app, which relays instructions from AI servers and expects the body to obey them without question). BragJack targets the trust boundary between the two, using nothing more exotic than a browser extension with content-script and network-modification permissions — capabilities hundreds of millions of installed extensions already have.
How Prompt Forcing Works
Weizman calls the underlying technique Prompt Forcing, and distinguishes it from classic prompt injection. Traditional prompt injection hides malicious instructions inside content the AI is already reading (an email, a web page, a document) and hopes the model follows them. Prompt Forcing skips that step entirely: the malicious extension impersonates the vendor's trusted "brain" and hands the browser's privileged "body" a complete, fully-formed prompt plus follow-up instructions, which the body then carries out using its own legitimate permissions.
The extension achieved this using two standard, non-exotic Chromium extension capabilities: content scripts (to inject JavaScript into pages) and the declarativeNetRequest (DNR) API, which can rewrite network requests and response headers. In Chrome's case, DNR rules weakened security headers and substituted attacker-controlled JavaScript into the network requests that load Gemini's web app, effectively taking over the "body" side of the assistant without ever injecting a script directly into Gemini's own page.
Affected Products
| Product | Vendor | CVE | Bounty | Notes |
|---|---|---|---|---|
| Chrome (Gemini Live) | CVE-2026-0628 (CVSS 8.8) | $7,000 | DNR-based header and script substitution; exposed local files, browsing history, screenshots, and camera/microphone access | |
| Microsoft Edge | Microsoft | CVE-2026-55945 | $5,000 | Race condition flipped the agent from "Think" mode to "Do" mode mid-prompt before restrictions re-armed |
| Perplexity Comet | Perplexity | Not assigned | $7,000 | Main app blocked extension access, but a leftover testing.perplexity.com domain lacked the same protections, giving full file, history, and screenshot access |
| Opera Neon | Opera | Not assigned | $900 | Extension impersonated the trusted control channel to script full inbox summarization and exfiltration |
| Claude in Chrome | Anthropic | Not assigned | $600 | Rated least severe by Forever Security itself — "Claude in Chrome is a browser extension, not a browser," so this was one extension abusing another rather than an extension abusing a full browser body |
In demonstrations, a hijacked agent could be told, in plain English, to open a victim's inbox, summarize recent messages, and forward them to an attacker-controlled address — no obfuscation or code injection into the target site required.
Why This Matters
BragJack is a reminder that agentic browsers introduce a genuinely new attack surface, not just a new flavor of an old one. Any user running one of these five browsers with even one extension installed was theoretically exposed, since the flaw lived in how the browser's AI agent trusted its own vendor's communication channel — not in the target website's code. All five vendors have since shipped fixes (Google and Microsoft via browser updates, Anthropic via a Claude-in-Chrome patch, Opera and Perplexity via their own remediations), and these are researcher-disclosed findings rather than attacks observed in the wild. But Weizman is explicit that the patches close the specific paths he found, not the underlying architecture: Chromium extensions with content-script and DNR access can, in principle, still reach browser-embedded AI agents, because that trust boundary is what makes agentic browsers work at all.
Protective Measures
- Update immediately. Chrome (143.0.7499.192/.193) and Edge (150.0.4078.48 and later) both ship fixes for the disclosed CVEs; confirm Opera, Perplexity Comet, and Claude in Chrome are on current versions as well.
- Audit installed extensions. Remove anything unused or unrecognized, and scrutinize extensions that request broad "read and change all your data on all websites" permissions — that's exactly the access BragJack abused.
- Treat AI browser agents as a privileged surface. Where an agentic browser feature isn't needed, disable it; organizations should consider extension allow-listing via admin policy rather than relying on users to self-police.
- Watch for anomalous agent behavior, such as unexpected file access, screenshot activity, or outbound messages the user didn't initiate — these are the observable side effects of a hijacked agent acting "legitimately" on the attacker's behalf.
- Enterprises should evaluate whether built-in AI browser agents should be restricted or disabled entirely on managed endpoints until the broader extension-to-agent trust model is hardened industry-wide.
References and Related Reading
- BleepingComputer: BragJack attacks hijack AI browser agents through malicious extensions
- Forever Security: BragJack — How We Hijacked 5 of the World's Most Popular Browsers Using Their Built-In AI Assistants
- The Hacker News: One Extension Could Hijack AI Assistants Across Chrome, Comet, Edge, Opera Neon and Claude
- Dark Reading: BragJack Attack Can Turn a Browser's Agentic AI Against It