Security researcher Gal Weizman of Forever Security has revealed a new attack technique that can hijack the AI assistants built into popular browsers using a single malicious browser extension.
The proof-of-concept, called BragJack, was demonstrated using five Chromium-based browsers or browser assistants: Google Chrome’s Gemini Live, Perplexity Comet, Microsoft Edge, Opera Neon, and Anthropic’s Claude in Chrome.
The research netted the five vendors more than $20,000 in error awards, ranging from $600 to $7,000, and produced two CVEs.
The attack requires the malicious extension to already be installed in the victim’s browser.
Once this is the case, the researcher shows that the abuse can occur without user interaction, allowing an extension to control an AI browser agent and abuse its existing permissions to access sensitive information or act on behalf of the victim.
Both Google and Microsoft have now corrected the deficiencies assigned to them.
Abuse of trusted browser components
The attacks exploit the way AI assistants are increasingly integrated into browsers and provide browser-level functionality.
In his essay Weizman describes These systems have a “brain” and a “body”. The AI model processes instructions and decides what should happen.
A privileged browser component then carries out the actions, e.g. B. accessing tabs, reading content, taking screenshots, or interacting with websites.
The problem, according to the researcher, is that browser extensions can manipulate web traffic and pages that these privileged components trust.
The same extension was used for all five targets and relied on Chromium declarativeNetRequest (DNR) functionality. DNR allows extensions to change the way network requests are handled, including changing response headers and redirecting resources.
In the Chrome attack, Weizman found that extensions were prevented from directly touching the privileged chrome://glic Component or injecting scripts into Google’s Gemini website, DNR rules could still intercept requests made by the embedded Gemini web app.
By weakening security headers and redirecting a JavaScript resource, it executed code within the Gemini context and communicated directly with Chrome’s privileged AI component, rather than going through Gemini’s normal request flow.
According to Weizman, the resulting access could read local files, access web content, take screenshots and potentially reach the browser’s camera and microphone. Chrome assigned the finding CVE-2026-0628 and paid a bounty of $7,000.
From reading data to controlling AI agents
The attacks against agent browsers like Perplexity Comet and Opera Neon go even further because their agents can act on websites instead of just reading them.
For Comet, Weizman found that the browser’s built-in agent extension trusted several Perplexity domains, including a test domain that did not receive the same protection as the primary website perplexity.ai. By using DNR to remove a redirect to that domain, he loaded it and inserted a content script that could communicate with the built-in agent.
The resulting access included browsing history, screenshots, local files, and the ability to send instructions to the agent. Weizman demonstrated how he forced the agent to visit Perplexity, aggregate the victim’s emails, and send the results to a different address.
Microsoft Edge presented a different challenge. Microsoft had split its agent into “thinking” and “doing” modes to prevent it from executing arbitrary instructions and actions at the same time.
Weizman found a race condition that briefly disables the constraint while forcing a prompt, and then re-enables actionability before the agent checks its status. assigned to Microsoft CVE-2026-55945 to racing conditions.
Similar flaws have been found with Opera Neon and Claude in Chrome, although the latter itself is a browser extension rather than a browser.
Earlier this year, as part of my work at Manifold Security reported a related vulnerability in Claude for Chrome: the extension ran its built-in AI workflows on synthetic clicks without verifying that they came from a real user, and the flagged code was still reproducible eight releases later.
This is what followed Claude Bleeda previous bug in the same extension that LayerX disclosed in April and that Claude trusted for Chrome Claude.ai origin, rather than checking which script actually controlled it.
“Prompt forcing”
Weizman calls the technique used to seize these agents “prompt forcing.”
Unlike traditional prompt injection, in which an attacker attempts to inject malicious instructions into content that an AI is already reading, prompt forcing allows the attacker to give the agent a complete prompt and subsequent instructions. The agent then translates these instructions into legitimate browser actions using its existing permissions.
This is important for endpoint defense, the researcher argues, because the final action is not carried out by conventional malicious code. Legitimate software is instructed to carry out the attack.
BragJack points to a growing challenge as browsers and other endpoint apps have more powerful AI agents. A compromised extension that would traditionally only see web content can, in some designs, become a path to software that reads files, crawls data, and acts on websites for the user.
Users should keep their browsers fully updated, remove extensions that they do not recognize or no longer use, and treat general permission requests to read and modify all of your data across all websites with caution.
In addition to his article, Weizman published one complete technical glitch covers all five attacks.
