BragJack Attack Lets Malicious Extensions Hijack AI Agents Across 5 Major Browsers
Researchers demonstrated 'BragJack' browser-extension attacks that hijack AI agents in Chrome, Edge, Comet, Opera Neon, and Claude, leading to two CVEs and vendor patches.
Forever Security researcher Gal Weizman showed that a malicious extension using content scripts and the declarativeNetRequest API can inject 'forced prompts' into the trusted channels of AI agents across five Chromium-based environments. Chrome's Gemini flaw was tracked as CVE-2026-0628 (CVSS 8.8) and fixed in Chrome 143.0.7499.192/.193, while an Edge Copilot race condition was assigned CVE-2026-55945 and fixed in Edge 150.0.4078.48. The Perplexity Comet agent had the broadest impact via an unprotected testing origin, enabling local-file reads, screenshots, and camera or microphone access. No in-the-wild attacks were reported, and vendors paid roughly $20,000 in combined bounties.
- Malicious extensions abused content scripts and declarativeNetRequest rules to inject prompts into trusted AI agent channels
- Chrome Gemini flaw CVE-2026-0628 rated 8.8, fixed in Chrome 143.0.7499.192/.193
- Edge Copilot race condition CVE-2026-55945 fixed in version 150.0.4078.48
- Comet attack leveraged an unprotected Perplexity test origin for file, screenshot, and camera access
- No in-the-wild exploitation reported; defenders urged to allowlist extensions and restrict DNR permissions
- Organizations
- Forever Security
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-0628 | Insufficient policy enforcement in WebView tag in Google Chrome prior to 143.0.7499.192 allowed an attacker who convinced a user to install a malicious… | 8.8 | 7% | ||
| CVE-2026-55945 | Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Edge (Chromium-based) allows an authorized attacker to… | 4.2 | <1% |
From the original article
3 min read at cybersecuritynews.com
A new attack technique dubbed “BragJack” allows a malicious browser extension to seize trusted communication channels used by AI assistants in Chrome, Edge, Opera Neon, Comet, and Claude in Chrome. Rather than bypassing model guardrails or hiding instructions inside web content, the proof-of-concept attacks directly supplied commands to privileged browser components, turning an assistant into […]
By Guru Baran · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.