BragJack Attack Lets Malicious Extensions Hijack AI Agents Across 5 Major Browsers

A new attack technique dubbed “BragJack” allows a malicious browser extension to seize trusted communication channels used by AI assistants in Chrome, Edge, Opera Neon, Comet, and Claude in Chrome.

Rather than bypassing model guardrails or hiding instructions inside web content, the proof-of-concept attacks directly supplied commands to privileged browser components, turning an assistant into a tool for theft and unauthorized actions.

Forever Security researcher Gal Weizman demonstrated the technique across all five Chromium-based environments using one extension with browser-specific rules.

The extension primarily used content scripts and the declarativeNetRequest API (DNR), which can modify network traffic. Commonly used by ad blockers, these capabilities helped untrusted code cross into a privileged AI control plane.

According to research published by Forever Security, the weakness lies in the architecture connecting an AI “brain” hosted on a vendor-controlled website to a powerful “body” inside the browser.

The body can inspect pages or operate websites, while a trusted web origin delivers instructions. By manipulating that trusted origin or a page authorized to communicate with the agent, the malicious extension could issue its own instructions as though they came from the browser vendor.

Researchers call this approach “prompt forcing” to distinguish it from prompt injection. In prompt injection, hostile instructions are embedded in content the model processes.

BragJack gives the attacker control over the complete prompt, its timing, and follow-up commands. It abuses authorization and message-channel trust before the AI evaluates intent, so model-level safety filters cannot correct the isolation failure.

Chrome’s Gemini implementation blocked content-script injection into its embedded web application but failed to stop DNR rules from intercepting resources loaded inside the privileged WebView.

The researchers replaced a legitimate JavaScript resource and executed code within Gemini’s trusted context, gaining the ability to read local files, capture screenshots, expose profile information, and activate the camera or microphone.

Google tracked the high-severity issue as CVE-2026-0628, rated 8.8, and fixed it in Chrome 143.0.7499.192/.193.

Comet produced the broadest impact. Its built-in agent trusted several Perplexity origins, including an unprotected testing domain.

The extension removed that domain’s redirect header, injected a content script, and communicated directly with the agent, enabling browsing-history access, screenshots, profile leakage, local-file reading, and autonomous activity on authenticated websites.

On Opera Neon, code running on opera.com could send arbitrary agent prompts.

Microsoft Edge required a more complex chain. A Microsoft marketing page could place prompts into Copilot, while separate “Think” and “Do” modes kept prompt intake apart from browser actions.

Researchers tired framing restrictions and exploited a race condition by switching modes at the right moment, causing the agent to execute a forced prompt. Microsoft assigned CVE-2026-55945, a medium-severity race condition affecting Edge versions before 150.0.4078.48.

Claude in Chrome was an extension-on-extension case rather than a browser compromise. Researchers abused a Claude marketing page permitted to pass prompts to the side panel, then generated the expected click-through debugger privileges.

Attacker-selected instructions could then drive Claude’s actions, showing how one extension can undermine another through exposed privileged messaging interfaces.

A malicious extension had to be installed first, so “zero click” describes exploitation after installation, not an internet-based compromise without prior user action. Researchers reported no in-the-wild attacks; the vendors paid approximately $20,000 in combined bounties.

Organizations should update Chrome and Edge immediately, keep AI-enabled browsers and assistants current, and remove unnecessary extensions.

Enterprise defenders should enforce extension allowlists, restrict broad host and DNR permissions, scrutinize debugger access, and monitor unusual browser-driven access to files, microphones, cameras, email, and authenticated applications.

Security teams should also treat AI-agent activity as a distinct telemetry source, correlating prompts and browser actions with identity, data-access, and network logs to identify trusted software behaving outside the user’s expected workflow patterns.

BragJack’s larger lesson is that AI agents need strict origin validation, least privilege, isolated command channels, explicit confirmation for sensitive actions, and audit logs that security teams can inspect.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC