BragJack attacks hijack AI browser agents through malicious extensions
Forever Security's Gal Weizman disclosed BragJack, a malicious-extension technique hijacking AI browser agents from Chrome Gemini to Claude, earning $20,000 in bounties.
Researcher Gal Weizman of Forever Security demonstrated BragJack attacks against Chrome's Gemini Live, Perplexity Comet, Microsoft Edge, Opera Neon, and Anthropic's Claude in Chrome using a single malicious extension. The attacks abuse Chromium's declarativeNetRequest to weaken security headers and redirect resources, culminating in a 'Prompt Forcing' technique that hands the agent an entire attacker-controlled prompt executed with its existing privileges. The work earned over $20,000 in bounties and two CVEs; Google (CVE-2026-0628) and Microsoft (CVE-2026-55945, a Think/Do race condition) have patched. Compromised agents could read local files, browsing history, take screenshots, and act on websites, such as exfiltrating summarized emails.
- Single malicious extension abuses Chromium declarativeNetRequest to hijack AI browser agents without user interaction.
- Prompt Forcing supplies the agent an entire attacker prompt, translated into legitimate privileged browser actions.
- Bounties ranged from $600 to $7,000 across five vendors, totaling more than $20,000.
- Edge flaw was a race condition briefly disabling its Think/Do separation; both vendors patched.
- Follows earlier ClaudeBleed and synthetic-click flaws in Claude for Chrome.
- Organizations
- Forever Security
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-0628 | Insufficient policy enforcement in WebView tag in Google Chrome prior to 143.0.7499.192 allowed an attacker who convinced a user to install a malicious… | 8.8 | 7% | ||
| CVE-2026-55945 | Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Edge (Chromium-based) allows an authorized attacker to… | 4.2 | <1% |
From the original article
4 min read at bleepingcomputer.com
BragJack, a proof-of-concept attack from Forever Security's Gal Weizman, hijacks the AI assistants in Chrome, Edge, Opera Neon, Perplexity Comet, and Claude in Chrome using one malicious extension. The Prompt Forcing technique earned over $20,000 in bounties and two CVEs. [...]
By Ax Sharma · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.