BragJack Attack Hijacks AI Browser Agents

Security researcher Gal Weizman of Forever Security has disclosed BragJack, a new attack technique that hijacks AI browser agents through malicious extensions. The proof-of-concept works against five major Chromium-based browsers and assistants, earned over $20,000 in bug bounties, and produced two CVEs. Both Google and Microsoft have since patched their assigned flaws.

What Happened: BragJack Hijacks AI Browser Agents via Malicious Extensions

BragJack is a proof-of-concept attack demonstrated against Google Chrome’s Gemini Live, Perplexity Comet, Microsoft Edge, Opera Neon, and Anthropic’s Claude in Chrome. The attack uses a single malicious browser extension to seize control of built-in AI assistants. Once installed, the extension can run without user interaction and abuse the agent’s existing privileges.

Weizman calls the underlying technique “Prompt Forcing.” Unlike traditional prompt injection, where attackers try to slip malicious instructions into content the AI is already reading, Prompt Forcing lets the attacker hand the agent an entire prompt and follow-up instructions. Consequently, the agent translates those instructions into legitimate browser actions using its existing privileges.

Technical Details of the BragJack Attack

The attacks exploit the way AI assistants are increasingly wired into browsers and granted browser-level capabilities. Weizman describes these systems as having a “brain” and a “body.” The AI model processes instructions and decides what should happen. Then a privileged browser component performs the actions, such as accessing tabs, reading content, taking screenshots, or interacting with websites.

The problem is that browser extensions can manipulate web traffic and pages that these privileged components trust. The same malicious extension was used across all five targets, relying on Chromium’s declarativeNetRequest (DNR) functionality. DNR lets extensions modify how network requests are handled, including changing response headers and redirecting resources.

Google Chrome and Gemini Live Exploit

In the Chrome attack, Weizman found that although extensions were blocked from directly touching the privileged chrome://glic component or injecting scripts into Google’s Gemini site, DNR rules could still intercept requests made by the embedded Gemini web app. By weakening security headers and redirecting a JavaScript resource, he executed code inside the Gemini context. Therefore, he communicated directly with Chrome’s privileged AI component rather than going through Gemini’s normal request flow.

The resulting access could read local files, reach web content, take screenshots, and potentially reach the browser’s camera and microphone. Chrome assigned the finding CVE-2026-0628 and paid a $7,000 bounty.

Microsoft Edge Race Condition Exploit

Microsoft Edge presented a different challenge. Microsoft had split its agent into “Think” and “Do” modes to stop it from taking arbitrary instructions and actions at the same time. Weizman found a race condition that briefly disables the restriction while forcing a prompt, then re-enables the action capability before the agent checks its state. Microsoft assigned CVE-2026-55945 to the race condition.

Perplexity Comet and Opera Neon

For Comet, Weizman found the browser’s built-in agent extension trusted several Perplexity domains, including a testing domain that did not get the same protections as the primary perplexity.ai site. By removing a redirect to that domain with DNR, he loaded it and injected a content script able to talk to the built-in agent. The resulting access included browsing history, screenshots, local files, and the ability to send instructions to the agent. He demonstrated forcing the agent to visit Perplexity, summarize the victim’s emails, and send the results to another address.

Similar flaws were demonstrated against Opera Neon and Claude in Chrome, though the latter is itself a browser extension rather than a browser.

Business and Operational Impact

• Data exposure risk: Compromised agents can read local files, browsing history, clipboard contents, and sensitive documents.
• Account takeover potential: Attackers can force AI agents to act on websites on the victim’s behalf, including sending emails and accessing accounts.
• Media access: In some cases, the attacks could potentially reach the browser’s camera and microphone.
• Endpoint defense bypass: The final action is carried out by legitimate software, not conventional malicious code, making detection harder.
• Supply chain concern: Malicious extensions in the Chrome Web Store or third-party sources could compromise enterprise devices at scale.

Mitigation and Recommendations

Immediate Actions for Defenders

1. Keep browsers fully updated to ensure CVE-2026-0628 and CVE-2026-55945 patches are applied.
2. Remove extensions that are unrecognized or no longer used.
3. Treat broad “read and change all your data on all websites” permission prompts with extreme caution.
4. Audit installed extensions across enterprise endpoints for unnecessary DNR permissions.
5. Monitor for anomalous AI agent activity, such as unexpected email summaries or website interactions.

Security Architecture Considerations

BragJack points to a growing challenge as browsers and other endpoint apps gain more capable AI agents. A compromised extension that would traditionally see only web content can become a path to software that reads files, browsing data, and acts on websites for the user. Furthermore, the attack surface expands as more vendors integrate AI agents directly into browsers.

Bottom line: Organizations should treat AI browser agents as high-value targets, audit extension permissions aggressively, and keep browsers patched to close the window on Prompt Forcing attacks.

Incident Summary

CVE ID / Incident:	CVE-2026-0628 (Chrome), CVE-2026-55945 (Edge)
Affected Systems:	Google Chrome (Gemini Live), Microsoft Edge, Perplexity Comet, Opera Neon, Claude in Chrome
Disclosure Date:	September 19, 2026
Patch Status:	Google and Microsoft have patched; verify browser updates
Researcher:	Gal Weizman, Forever Security
Bounty Total:	Over $20,000 across five vendors

References

1. Gal Weizman, Forever Security, “BragJack: Hijacking 5 Browsers via Built-in AI Assistants,” September 19, 2026, https://forever.security/blog/bragjack-hijacking-5-browsers-via-built-in-ai-assistants/, accessed September 19, 2026.
2. Bill Toulas, BleepingComputer, “BragJack Attacks Hijack AI Browser Agents Through Malicious Extensions,” September 19, 2026, https://www.bleepingcomputer.com/news/security/bragjack-attacks-hijack-ai-browser-agents-through-malicious-extensions/, accessed September 19, 2026.
3. Google Chrome Releases, “Stable Channel Update for Desktop,” January 2026, https://chromereleases.googleblog.com/2026/01/stable-channel-update-for-desktop.html, accessed September 19, 2026.
4. Microsoft Security Response Center, “CVE-2026-55945,” https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55945, accessed September 19, 2026.