BragJack Attack Hijacks AI Assistants in 5 Popular Browsers With Zero Clicks
Researchers disclosed BragJack, a zero-click extension attack hijacking AI assistants in Chrome, Edge, Opera, Comet, and Claude.
68
Vulnerability1 · 1 read
CVE-2026-55945
- CVSS 3.1
- 4.2 medium
- EPSS
- <1%p8
- Published
- ·
- Modified
Description · NVD
Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Edge (Chromium-based) allows an authorized attacker to disclose information locally.
- Vendors
- microsoft
- Products
- edge chromium
- Weakness
- CWE-362
- Vector
- CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N
In the news
4 storiesBragJack Attack Lets Malicious Extensions Hijack AI Agents Across 5 Major Browsers
Researchers demonstrated 'BragJack' browser-extension attacks that hijack AI agents in Chrome, Edge, Comet, Opera Neon, and Claude, leading to two CVEs and vendor patches.
68
BragJack attacks hijack AI browser agents through malicious extensions
Forever Security's Gal Weizman disclosed BragJack, a malicious-extension technique hijacking AI browser agents from Chrome Gemini to Claude, earning $20,000 in bounties.
65
One Extension Could Hijack AI Assistants Across Chrome, Comet, Edge, Opera Neon and Claude
Researchers showed a single browser extension could hijack AI agents in Chrome, Edge, Comet, Opera Neon and Claude in Chrome, earning $20,000 in bounties.
62