Security researcher Gal Weizman of Forever Security has disclosed a new attack technique called BragJack. The method can hijack built-in AI assistants in popular browsers using a single malicious browser extension. The proof-of-concept was demonstrated against five Chromium-based browsers or browser assistants. These include Google Chrome's Gemini Live, Perplexity Comet, Microsoft Edge, Opera Neon, and Anthropic's Claude in Chrome.
The research earned more than $20,000 in bug bounties from the five vendors, ranging from $600 to $7,000, and produced two CVEs. The attack requires the malicious extension to already be installed in the victim's browser. Once it is, the abuse can run without user interaction. This lets an extension control an AI browser agent and abuse its existing privileges to access sensitive information or act on the victim's behalf. Both Google and Microsoft have since resolved the flaws they were assigned.
The attacks exploit the way AI assistants are increasingly wired into browsers and handed browser-level capabilities. Weizman describes these systems as having a brain and a body. The AI model processes instructions and decides what should happen. A privileged browser component then performs the actions, such as accessing tabs, reading content, taking screenshots, or interacting with websites. The problem is that browser extensions can manipulate web traffic and pages that these privileged components trust.
The same extension was used across all five targets, relying on Chromium's declarativeNetRequest functionality. This feature lets extensions modify how network requests are handled, including changing response headers and redirecting resources. In the Chrome attack, Weizman found that although extensions were blocked from directly touching the privileged chrome://glic component or injecting scripts into Google's Gemini site, declarativeNetRequest rules could still intercept requests made by the embedded Gemini web app.
By weakening security headers and redirecting a JavaScript resource, he executed code inside the Gemini context. This communicated directly with Chrome's privileged AI component rather than going through normal request flow. The resulting access could read local files, reach web content, take screenshots, and potentially reach the browser's camera and microphone. Chrome assigned the finding CVE-2026-0628 and paid a $7,000 bounty.
The attacks against agentic browsers such as Perplexity Comet and Opera Neon go further because their agents can act on websites rather than merely read them. For Comet, Weizman found the browser's built-in agent extension trusted several Perplexity domains, including a testing domain that did not get the same protections as the primary domain. By removing a redirect to that domain, he loaded it and injected a content script able to talk to the built-in agent.
The resulting access included browsing history, screenshots, local files, and the ability to send instructions to the agent. Weizman demonstrated forcing the agent to visit Perplexity, summarize the victim's emails, and send the results to another address. Microsoft Edge presented a different challenge. Microsoft had split its agent into Think and Do modes to stop it from taking arbitrary instructions and actions at the same time.
Weizman found a race condition that briefly disables the restriction while forcing a prompt, then re-enables the action capability before the agent checks its state. Microsoft assigned CVE-2026-55945 to the race condition. Similar flaws were demonstrated against Opera Neon and Claude in Chrome, though the latter is itself a browser extension rather than a browser. Weizman calls the technique used to seize these agents Prompt Forcing.
Unlike conventional prompt injection, where an attacker tries to slip malicious instructions into content an AI is already reading, Prompt Forcing lets the attacker hand the agent an entire prompt and follow-up instructions. The agent then translates those instructions into legitimate browser actions using its existing privileges. This matters for endpoint defenses because the final action is not carried out by conventional malicious code, and legitimate software is being told to perform the attack.
BragJack points to a growing challenge as browsers and other endpoint apps gain more capable AI agents. A compromised extension that would traditionally see only web content can, in some designs, become a path to software that reads files, browsing data, and acts on websites for the user. Users should keep browsers fully updated, remove extensions they do not recognize or no longer use, and treat broad read and change all your data on all websites permission prompts with caution. In addition to his writeup, Weizman has published a full technical breakdown covering all five attacks.
