A newly disclosed BragJack is a browser-extension attack technique that can hijack built-in AI assistants across five AI-enabled browsers.
The research demonstrates how a single malicious browser extension could allegedly abuse trusted communication paths between cloud-hosted AI models and privileged browser agents, enabling unauthorized commands, sensitive-data access, and browser-level actions.
Forever Security researcher Gal Weizman reported that BragJack affected Gemini Live in Google Chrome, Microsoft Edge, Opera Neon, Perplexity Comet, and Claude in Chrome.
BragJack Attack Lets Browser Extensions Hijack AI Agents
The vulnerabilities were disclosed to vendors through responsible channels and generated bounty awards from Google, Microsoft, Perplexity, Opera, and Anthropic. The findings include CVE-2026-0628 and CVE-2026-55945.
The BragJack technique does not depend on traditional prompt injection, where attackers manipulate an existing user prompt with hidden or malicious instructions. Instead, it targets the architecture behind browser AI assistants. AI-enabled browsers commonly separate their assistants into two components.
A cloud-based AI service acts as the decision-making layer, while a privileged local browser component executes actions such as accessing webpages, summarizing content, handling tabs, or interacting with browser data.
This local component trusts instructions delivered through specific vendor-controlled websites or internal communication channels. Gal Weizman found that a malicious extension could exploit that trust model.
Standard extension capabilities, including webpage script injection and network-request modification, could potentially be used to alter the resources or webpages that communicate with an AI agent.
Once an attacker gains control of a trusted command path, the browser agent may treat attacker-generated instructions as legitimate.
In Chrome, Google reportedly blocked direct extension script injection on Gemini pages but initially allowed extensions to modify relevant network requests. This enabled researchers to replace a trusted JavaScript resource with attacker-controlled code.
According to Gal Weizman, the resulting attack could allow browser screenshots, local-file access, microphone and camera activation, and browser-profile data collection without requiring a victim to click anything.
Opera Neon was reportedly easier to target because extensions could run code on a trusted Opera page used to communicate with its AI agent.
This created a path for an extension to send agent commands, including instructions to open email and summarize messages. The researchers also described using traffic-modification capabilities to hide parts of the activity from the user.
The Microsoft Edge exploit involved a more complex chain. The researchers identified a Microsoft marketing page with special permissions to communicate with the browser’s AI functionality.
They then combined this with a race condition involving Edge’s “Think” and “Do” modes. By submitting a prompt in one mode and quickly switching the agent to another, the researchers said they could make the agent execute attacker-provided instructions.
Claude in Chrome was also susceptible via a trusted Anthropic-controlled page that could send messages to the assistant.
Although that scenario involved one extension targeting another extension, rather than a browser compromise, the researchers said it could still expose sensitive data accessible through Claude’s browser integration.
Perplexity Comet was described as the most severe case because its AI agent had broad browser permissions. Researchers discovered that a testing domain, testing.perplexity.com, was still authorized to issue commands to the agent.
An extension could reportedly suppress the domain’s redirect to the main Perplexity site, load the testing page in the background, and inject code into it.
This could provide access to screenshots, browsing history, user data, agent-driven actions, and potentially files stored on the local operating system. BragJack highlights how malicious extensions can transform trusted AI agents into attack tools.
Organizations should enforce strict browser-extension controls, remove unnecessary add-ons, deploy vendor patches quickly, and monitor AI-agent activity at runtime.
AI browser vendors must also ensure that no extension can modify the webpages, scripts, or network flows authorized to control privileged agents.
Join 16,000+ SOC teams using ANY.RUN to streamline threat investigations and reduce manual effort. Explore for your team
