BragJack: a malicious extension hijacks the AI agents in Chrome, Edge, Comet, Opera Neon and Claude in Chrome

Executive Summary

On September 19, 2026, security researcher Gal Weizman of Forever Security disclosed BragJack, a proof-of-concept technique in which a single malicious browser extension seizes control of the AI assistant built into a browser and abuses that assistant's privileges to read data and act on the victim's behalf.¹ Weizman demonstrated it against five agentic-browser environments: Google Chrome's Gemini Live, Perplexity Comet, Microsoft Edge, Opera Neon, and Anthropic's Claude in Chrome.¹² The research earned more than $20,000 in bug bounties across the five vendors (individual awards from $600 to $7,000) and produced two CVEs.¹

The technique targets a structural pattern in how AI is being wired into browsers. Weizman frames these systems as having a "brain" — the AI model that decides what to do — and a "body," a privileged browser component that carries out actions like reading tabs, taking screenshots, or interacting with sites.¹ The problem is that ordinary browser extensions can manipulate the web traffic and pages that the privileged "body" trusts. Using Chromium's declarativeNetRequest (DNR) API — which lets an extension modify how network requests are handled, including rewriting response headers and redirecting resources — the same extension was turned against all five targets.¹ In the Chrome case, although extensions were blocked from directly touching the privileged chrome://glic component or injecting scripts into Google's Gemini site, DNR rules could still intercept the embedded Gemini web app's own requests; by weakening security headers and redirecting a JavaScript resource, Weizman executed code inside the Gemini context and communicated directly with Chrome's privileged AI component. Google assigned CVE-2026-0628 and paid a $7,000 bounty.¹³

Against agentic browsers that can act on sites rather than merely read them, the impact is larger. For Perplexity Comet, Weizman found the built-in agent trusted several Perplexity domains, including a testing domain that lacked the protections of the main site; by removing a redirect to it with DNR and injecting a content script, he could send instructions to the agent — and demonstrated forcing it to visit Perplexity, summarize the victim's emails, and send the results to another address.¹ Microsoft Edge had split its agent into "Think" and "Do" modes precisely to stop it taking arbitrary instructions and actions at once; Weizman found a race condition that briefly disables the restriction while forcing a prompt, then re-enables the action capability before the agent re-checks its state. Microsoft assigned CVE-2026-55945 to that race condition.¹⁴ Both Google and Microsoft have resolved the flaws they were assigned.¹

Weizman names the underlying technique Prompt Forcing, and the distinction from ordinary prompt injection is the point worth carrying away. Injection tries to slip malicious instructions into content the model is already reading; Prompt Forcing hands the agent an entire prompt and its follow-up instructions, and the agent then translates them into legitimate browser actions using its own privileges.¹ The security consequence is that the damaging action is performed by trusted software, not by conventional malicious code — which is exactly what most endpoint defenses are not looking for.¹ BragJack is a proof-of-concept: it requires a malicious extension to already be installed, and no in-the-wild exploitation has been reported.¹

Disclosure: One of the five targets in this research is Anthropic's Claude in Chrome, and this paper was researched and drafted by Claude, an AI assistant made by Anthropic. ThreatPaper has no financial or editorial relationship with Anthropic or any vendor named here; this is reported using the same evidentiary standard applied to any other party.

Verification of Claims

1. Claim: A malicious browser extension can hijack the AI assistants in five major agentic browsers. → Verified (as a proof-of-concept) → Demonstrated by the researcher against Chrome's Gemini Live, Perplexity Comet, Microsoft Edge, Opera Neon and Claude in Chrome, with two CVEs assigned and over $20,000 in bounties paid across the vendors.¹

2. Claim: The Chrome and Edge flaws are real and were fixed. → Verified → CVE-2026-0628 (Chrome, extension injection into a privileged context) and CVE-2026-55945 (Edge, a race condition) are both in the National Vulnerability Database, and BleepingComputer reports both vendors resolved them.¹³⁴

3. Claim: BragJack works with no user interaction. → Partially verified / preconditioned → True only once a malicious extension is already installed in the victim's browser; the attack does not run remotely or drive-by. It is a proof-of-concept, and the individual awards ($600–$7,000) reflect modest per-vendor severity, not an active mass-exploitation event.¹

Timeline

Attack Anatomy

Precondition: a malicious extension

BragJack requires a malicious extension already installed in the victim's browser, with the broad host permissions such extensions commonly request (T1176.001).¹ The single extension used in the research worked against all five targets by abusing Chromium's declarativeNetRequest API to modify how network requests are handled.¹

Chrome / Gemini Live — reach the privileged AI component

Extensions could not directly touch Chrome's privileged chrome://glic component or inject into Google's Gemini site, but DNR rules could intercept the embedded Gemini web app's requests. Weizman weakened security headers and redirected a JavaScript resource to execute code inside the Gemini context and talk directly to the privileged AI component, gaining the ability to read local files, reach web content, take screenshots, and potentially access the camera and microphone (T1185, T1005, T1113, T1123, T1125). Chrome assigned CVE-2026-0628.¹³

Perplexity Comet — send instructions to an acting agent

Comet's built-in agent trusted several Perplexity domains, including a testing domain without the main site's protections. By removing a DNR redirect and injecting a content script, Weizman could reach the agent and issue it instructions — demonstrated by forcing the agent to visit Perplexity, summarize the victim's emails, and send the results to another address (T1185, T1041).¹

Microsoft Edge — race the Think/Do guardrail

Edge split its agent into "Think" and "Do" modes to prevent it accepting instructions and taking actions simultaneously. Weizman found a race condition that briefly disables the restriction while forcing a prompt, then re-enables the action capability before the agent re-checks its state. Microsoft assigned CVE-2026-55945.¹⁴ Similar flaws were demonstrated against Opera Neon and Claude in Chrome.¹

Actor Profile

The "actor" here is an authorized security researcher; this section documents capability and method rather than hostile intent.

• Researcher: Gal Weizman, Forever Security.¹
• Method: Prompt Forcing — handing an AI browser agent an entire prompt and follow-up instructions (as opposed to prompt injection, which hides instructions in content the model is reading). The agent then executes the instructions as legitimate browser actions using its own privileges.¹
• Why it matters for detection: Because the final action is carried out by trusted software rather than conventional malicious code, it evades endpoint defenses tuned to spot malware behavior.¹
• Related prior work on Claude in Chrome (context): BleepingComputer's author notes a prior Manifold Security finding that Claude for Chrome ran built-in AI workflows on synthetic clicks without verifying a real user, reportedly still reproducible eight releases later, and an earlier LayerX-disclosed flaw, "ClaudeBleed" (April), in which the extension trusted the claude.ai origin rather than checking which script was driving it.¹

MITRE ATT&CK techniques (verified on attack.mitre.org):

Technical Indicators

# BragJack is a disclosed research technique, not an observed in-the-wild
# campaign, so there is no attacker infrastructure to list. The relevant
# artifacts are the abused browser API and the assigned CVEs.
technique_name: "BragJack / Prompt Forcing"
abused_browser_api: "Chromium declarativeNetRequest (DNR)"
cves:
  - "CVE-2026-0628"    # Chrome: extension injection into a privileged context (fixed 143.0.7499.192)
  - "CVE-2026-55945"   # Microsoft Edge: race condition in the agent's Think/Do state
targets_demonstrated:
  - "Google Chrome (Gemini Live)"
  - "Perplexity Comet"
  - "Microsoft Edge"
  - "Opera Neon"
  - "Anthropic Claude in Chrome"
precondition: "a malicious extension already installed with broad host permissions"
network_iocs: none (proof-of-concept, no in-the-wild exploitation reported)
file_hashes: none disclosed

Legal and Regulatory Response

No law-enforcement or regulatory action applies; this was coordinated vulnerability disclosure. Five vendors paid bounties totalling more than $20,000, two CVEs were assigned (Chrome CVE-2026-0628, Edge CVE-2026-55945), and Google and Microsoft resolved their respective flaws.¹³⁴

Impact Assessment

• Confirmed: A single malicious extension can, as a proof-of-concept, seize the AI assistants in five major agentic browsers and abuse their privileges to read local files, capture the screen, reach web content, and — for browsers whose agents can act — issue instructions and exfiltrate data.¹
• Confirmed: Two CVEs assigned; Chrome and Edge flaws fixed.¹³⁴
• Reported: More than $20,000 in bounties across five vendors.¹
• Not established: Any in-the-wild exploitation. BragJack is a research technique with a required precondition (a pre-installed malicious extension); no victim organization or active campaign has been reported.¹
• Unknown: How many of the five vendors' fixes fully close the underlying "extension can manipulate what the privileged AI component trusts" design gap, versus patching the specific paths Weizman used.

Lessons and Defensive Recommendations

For browser and AI-agent vendors:

• The root issue is trust placement: the privileged AI component trusts network responses and page content that a mere extension can rewrite via DNR. Treat the channel between the AI "brain" and its privileged "body" as a security boundary that must authenticate what is driving it — not trust an origin, a domain allowlist, or a request simply because it appears to come from the assistant's own web app. The Comet testing-domain trust and the Claude-for-Chrome origin-trust issues are the same class of mistake.
• Guardrails implemented as revocable in-process state (Edge's Think/Do split) are raceable. Enforce action gating at a layer the model and page content cannot influence within a single execution window.

For SOC and endpoint teams:

• Prompt Forcing produces malicious outcomes through legitimate software taking legitimate-looking actions, so signature- and behavior-based endpoint detection tuned for malware will miss it. Monitor for the enabling conditions instead: newly installed extensions with broad host permissions, and AI-agent actions (email summarization and forwarding, file reads) that do not correspond to user activity.

For users and administrators:

• Treat "read and change all your data on all websites" extension permissions as high-risk, especially in a browser with an AI agent that can act. Remove unrecognized or unused extensions, keep browsers fully updated, and prefer managed extension allowlisting on corporate fleets.

Sources