BragJack Attack Hijacks AI Assistants in 5 Popular Browsers With Zero Clicks

Security researchers have revealed a zero-click attack technique known as BragJack, which could enable a malicious browser extension to hijack built-in AI assistants in popular browsers like Google Chrome, Microsoft Edge, Opera Neon, Perplexity Comet, and Claude in Chrome.

The research, published on September 16 by Gal Weizman of Forever Security, describes a common architectural vulnerability. This vulnerability allows highly privileged browser agents to accept commands from trusted web-based AI services.

If a malicious extension can manipulate or impersonate these trusted command channels, it may issue instructions to the local AI agent without any user interaction.

BragJack Attack

Modern AI-enabled browsers typically separate the assistant into two components: a cloud-hosted “brain” that processes prompts and a local browser component capable of accessing tabs, browsing data, files, and other device resources.

According to the researchers, BragJack exploits the trust relationship between these two components. Rather than bypassing an AI model’s safety controls through traditional prompt injection, this attack involves using a rogue extension to manipulate or alter the instructions delivered to the browser-resident agent. This methodology is referred to as “Prompt-Forcing.”

Unlike prompt injection, where malicious instructions are hidden in untrusted content, Prompt-Forcing allegedly gives an attacker control over the entire prompt flow, including follow-up instructions and their timing.

This control could let an attacker use legitimate AI agent functions for malicious purposes, such as opening email, summarizing sensitive messages, accessing browsing history, capturing screenshots, or navigating to websites and performing actions on the victim’s behalf.

BragJack’s impact varied across browsers. In Chrome, the researchers found that a malicious extension could manipulate network requests associated with Gemini’s web component, allowing code execution within the context that controls the browser assistant.

This could allow access to local files, screenshots, browser profile data, and even the microphone or camera. Google assigned CVE-2026-0628 to the Chrome issue and awarded a $7,000 bounty for the discovery.

Perplexity Comet was identified as the most severely affected case, as its agent reportedly had broad permissions throughout the browser.

Researchers discovered that a testing domain, testing.perplexity.com, could issue commands to Comet’s agent without the protections applied to the main Perplexity domain.

By preventing a redirect to the protected site, an extension could allegedly load the testing domain and control the browser agent. This access could have allowed the retrieval of screenshots, URL history, profile information, agent actions, and local files. Perplexity assigned CVE-2026-55945 to this issue and also issued a $7,000 bounty.

In Microsoft Edge, BragJack exploited a weakness in a trusted marketing page combined with a race condition between the browser agent’s “Think” and “Do” modes. This allowed instructions submitted in one mode to be executed after quickly switching to the other mode. Microsoft awarded $5,000 for these findings.

Opera Neon reportedly allowed extension-injected scripts from an Opera-controlled site to prompt its AI agent. The researchers noted that the agent could later access webmail and conduct browser actions invisibly. Opera awarded $900 for the discovery.

Claude in Chrome was also affected through an extension-to-extension attack. Anthropic classified this issue as medium severity and provided a $600 bounty.

BragJack underscores a growing risk around agentic software: trusted applications can perform sensitive tasks without traditional malware. Security tools that focus solely on detecting malicious binaries or scripts may struggle to identify an AI agent executing seemingly authorized actions in an unauthorized context.

Organizations should implement strict controls over browser extension installations, remove unnecessary extensions, promptly apply browser and AI assistant updates, and monitor for unusual browser-agent activity.

Browser vendors, on their part, need to enforce strict origin isolation, minimize agent privileges, eliminate exposed development endpoints, and prevent extensions from tampering with trusted AI command channels.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC