Security researcher Gal Weizman of Forever Security has disclosed a new attack technique that can hijack the AI assistants built into popular browsers using a single malicious browser extension.
Dubbed BragJack, the proof-of-concept was demonstrated against five Chromium-based browsers or browser assistants: Google Chrome’s Gemini Live, Perplexity Comet, Microsoft Edge, Opera Neon, and Anthropic’s Claude in Chrome.
The research earned more than $20,000 in bug bounties from the five vendors, ranging from $600 to $7,000, and produced two CVEs.
The attack requires the malicious extension to already be installed in the victim’s browser.
Once it is, the researcher shows the abuse can run without user interaction, letting an extension control an AI browser agent and abuse its existing privileges to access sensitive information or act on the victim’s behalf.
Both Google and Microsoft have since resolved the flaws they were assigned.
Abusing trusted browser components
The attacks exploit the way AI assistants are increasingly wired into browsers and handed browser-level capabilities.
In his writeup, Weizman describes these systems as having a “brain” and a “body.” The AI model processes instructions and decides what should happen.
A privileged browser component then performs the actions, such as accessing tabs, reading content, taking screenshots, or interacting with websites.
The problem, according to the researcher, is that browser extensions can manipulate web traffic and pages that these privileged components trust.
The same extension was used across all five targets, relying on Chromium’s declarativeNetRequest (DNR) functionality. DNR lets extensions modify how network requests are handled, including changing response headers and redirecting resources.
In the Chrome attack, Weizman found that although extensions were blocked from directly touching the privileged chrome://glic component or injecting scripts into Google’s Gemini site, DNR rules could still intercept requests made by the embedded Gemini web app.
By weakening security headers and redirecting a JavaScript resource, he executed code inside the Gemini context, communicating directly with Chrome’s privileged AI component rather than going through Gemini’s normal request flow.
Weizman says the resulting access could read local files, reach web content, take screenshots, and potentially reach the browser’s camera and microphone. Chrome assigned the finding CVE-2026-0628 and paid a $7,000 bounty.
From reading data to controlling AI agents
The attacks against agentic browsers such as Perplexity Comet and Opera Neon go further, because their agents can act on websites rather than merely read them.
For Comet, Weizman found the browser’s built-in agent extension trusted several Perplexity domains, including a testing domain that did not get the same protections as the primary perplexity.ai site. By removing a redirect to that domain with DNR, he loaded it and injected a content script able to talk to the built-in agent.
The resulting access included browsing history, screenshots, local files, and the ability to send instructions to the agent. Weizman demonstrated forcing the agent to visit Perplexity, summarize the victim’s emails, and send the results to another address.
Microsoft Edge presented a different challenge. Microsoft had split its agent into “Think” and “Do” modes to stop it from taking arbitrary instructions and actions at the same time.
Weizman found a race condition that briefly disables the restriction while forcing a prompt, then re-enables the action capability before the agent checks its state. Microsoft assigned CVE-2026-55945 to the race condition.
Similar flaws were demonstrated against Opera Neon and Claude in Chrome, though the latter is itself a browser extension rather than a browser.
Earlier this year, in my work at Manifold Security, I reported a related weakness in Claude for Chrome: the extension ran its built-in AI workflows on synthetic clicks without verifying they came from a real user, and the flagged code was still reproducible eight releases later.
That followed ClaudeBleed, an earlier flaw in the same extension that LayerX disclosed in April, in which Claude for Chrome trusted the claude.ai origin rather than checking which script was actually driving it.
‘Prompt Forcing’
Weizman calls the technique used to seize these agents Prompt Forcing.
Unlike conventional prompt injection, where an attacker tries to slip malicious instructions into content an AI is already reading, Prompt Forcing lets the attacker hand the agent an entire prompt and the follow-up instructions. The agent then translates those instructions into legitimate browser actions using its existing privileges.
That matters for endpoint defenses, the researcher argues, because the final action is not carried out by conventional malicious code. Legitimate software is being told to perform the attack.
BragJack points to a growing challenge as browsers and other endpoint apps gain more capable AI agents. A compromised extension that would traditionally see only web content can, in some designs, become a path to software that reads files, browsing data, and acts on websites for the user.
Users should keep browsers fully updated, remove extensions they do not recognize or no longer use, and treat broad “read and change all your data on all websites” permission prompts with caution.
In addition to his writeup, Weizman has published a full technical breakdown covering all five attacks.
Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed.
