BragJack Attacks Can Hijack AI Browser Agents Through Malicious Extensions

The BragJack attack is a newly disclosed technique that can potentially hijack AI assistants built directly into modern browsers through malicious extensions.

Security researcher Gal Weizman of Forever Security demonstrated the technique against five Chromium-based browsers or browser assistants: Google Chrome’s Gemini Live, Perplexity Comet, Microsoft Edge, Opera Neon, and Anthropic’s Claude in Chrome.

The research resulted in more than $20,000 in bug bounty payments from the affected vendors and led to the disclosure of two CVEs.

The attacks require a malicious extension to already be installed in the victim’s browser. Once installed, however, the extension could potentially manipulate trusted browser components and use the privileges available to an AI browser agent.

That creates a particularly important security concern as browsers increasingly move from simply displaying websites to allowing AI agents to read information, interact with pages, access browser data, and perform actions on behalf of users.

How the BragJack Attack Can Hijack AI Browser Agents

The BragJack technique takes advantage of the way modern browsers connect AI assistants with privileged browser functionality.

Weizman describes these systems as having two important components: a “brain,” represented by the AI model that interprets instructions, and a “body,” represented by browser components that actually perform actions.

Those actions can include accessing browser tabs, reading website content, taking screenshots, interacting with webpages, and performing other tasks.

The security problem arises when an untrusted browser extension can interfere with information or network requests that a privileged AI component considers trustworthy.

The research demonstrated that the same malicious extension could be used against multiple AI-powered browser environments by taking advantage of Chromium’s declarativeNetRequest (DNR) functionality.

DNR allows browser extensions to modify how network requests are handled, including redirecting resources and changing certain response headers.

According to Weizman’s research, these capabilities could be abused to interfere with the communication between browser-based AI assistants and their privileged components.

Chrome Gemini Attack Used Browser Request Manipulation

One of the demonstrated attacks targeted Google Chrome’s Gemini Live functionality.

Weizman found that browser extensions could not simply access the privileged chrome://glic component or inject scripts directly into Google’s Gemini interface.

However, the researcher discovered that DNR rules could still intercept requests made by the embedded Gemini web application.

By modifying security-related headers and redirecting a JavaScript resource, the proof-of-concept was able to execute code in the Gemini context and communicate with Chrome’s privileged AI component.

According to the research, this could provide access to sensitive browser capabilities, including reading local files, interacting with web content, taking screenshots, and potentially accessing the browser’s camera and microphone.

Google assigned the vulnerability CVE-2026-0628 and reportedly awarded a $7,000 bug bounty for the finding.

Google has since addressed the vulnerability.

For additional technical information about the Chrome vulnerability, Google’s Chrome Releases documentation provides information about security fixes released for the browser.

AI Browser Agents Create a Bigger Risk

The potential consequences become more serious when the targeted browser contains an AI agent capable of taking actions on websites.

Traditional browser assistants may primarily summarize information or answer questions. Agentic browsers can go further by navigating websites, clicking buttons, entering information, and carrying out multi-step tasks.

That means compromising the connection between an extension and an AI agent could potentially give an attacker more than access to information.

It could give them a way to influence what the AI agent does.

This distinction is central to the BragJack research.

Perplexity Comet Could Be Forced to Perform Actions

The research against Perplexity Comet demonstrated how an attacker could potentially move from reading information to controlling an AI agent.

Weizman found that the browser’s built-in agent extension trusted several Perplexity-related domains. One testing domain reportedly did not have the same level of protection as the primary perplexity.ai domain.

Using DNR functionality, the researcher was able to interfere with redirects involving that domain and inject a content script capable of communicating with the built-in agent.

The demonstrated access reportedly included browsing history, screenshots, local files, and the ability to send instructions to the agent.

In a proof-of-concept demonstration, the agent was instructed to visit Perplexity, summarize emails belonging to the victim, and send the resulting information to another email address.

This illustrates why AI agents can introduce a new dimension to browser security. An attacker may not need to directly steal every piece of information themselves if they can manipulate a legitimate AI agent that already has access to it.

Microsoft Edge Had a Different Weakness

Microsoft Edge used a different security mechanism for its AI agent.

Microsoft had separated the agent into “Think” and “Do” modes, designed to prevent the system from simultaneously receiving arbitrary instructions and executing actions.

Weizman discovered a race condition that could temporarily disable this restriction while a prompt was being forced into the system.

The proof of concept then attempted to restore the action capability before the agent checked its current state.

Microsoft assigned CVE-2026-55945 to the vulnerability.

Microsoft’s official security update provides additional information about the vulnerability.

Opera Neon and Claude in Chrome Were Also Tested

The research also demonstrated similar security weaknesses against Opera Neon and Claude in Chrome.

Claude in Chrome is particularly notable because it operates as a browser extension rather than being built directly into the browser itself.

The broader research therefore covers several different approaches to integrating AI into browsers.

Despite the differences between the products, the underlying concern is similar: AI agents are being given increasing levels of access to browser capabilities, while extensions and webpages operate within the same overall environment.

That creates opportunities for attackers if trust boundaries between those components are not properly enforced.

What Is Prompt Forcing?

Weizman describes the technique used in these attacks as “Prompt Forcing.”

The concept is related to prompt injection, but there is an important distinction.

In a conventional prompt-injection attack, malicious instructions are typically hidden inside content that an AI system is already processing. The attacker attempts to influence the model through information it encounters.

Prompt Forcing, as described in the BragJack research, involves taking control of the communication path to the AI agent and supplying the agent with instructions directly.

The AI then interprets those instructions and performs actions through its existing browser privileges.

This creates an unusual security problem because the final actions may be performed by legitimate browser software rather than conventional malware.

An attacker could potentially manipulate an AI agent into performing actions that the browser itself considers legitimate.

Why BragJack Matters for AI Security

BragJack highlights a security challenge that is likely to become more important as AI agents become integrated into everyday software.

Browser extensions have traditionally been able to interact with websites and modify parts of a user’s browsing experience. AI browser agents, meanwhile, are increasingly being given access to sensitive information and the ability to perform actions on behalf of users.

Those two capabilities create a potentially dangerous combination.

A compromised or malicious extension could become a bridge between untrusted code and a highly privileged AI assistant.

Instead of directly stealing information, an attacker could potentially manipulate the AI agent into retrieving or processing it.

Instead of directly interacting with a website, an attacker could potentially instruct the agent to perform the action.

The AI effectively becomes part of the attack chain.

How Users Can Protect Their Browsers

The BragJack research also highlights several practical steps users can take to reduce their exposure.

Keep your browser fully updated and install security updates as soon as they become available. Browser vendors regularly patch vulnerabilities affecting extensions, AI assistants, rendering engines, and privileged components.

Users should also regularly review their installed extensions and remove anything they no longer need or recognize.

Extension permissions deserve particular attention. An extension requesting permission to “read and change all your data on all websites” has significantly broader access than an extension that only needs to perform a narrowly defined task.

Avoid installing extensions from unfamiliar sources, and be cautious when an extension requests permissions that appear unrelated to its purpose.

For organizations, browser extensions should also be included in endpoint security policies. Restricting unauthorized extensions and monitoring browser activity can reduce the opportunities available to malicious software.

The Bigger Picture

BragJack demonstrates that AI browser security is becoming more complicated than simply protecting the AI model itself.

Modern AI assistants can have access to browser tabs, websites, files, screenshots, credentials, and other sensitive information. When those capabilities are combined with third-party extensions, the security boundary becomes much more complex.

The AI model may be secure on its own while the surrounding browser environment introduces a vulnerability.

That is why protecting AI agents requires more than securing the model. Browser extensions, APIs, permissions, network requests, authentication mechanisms, and privileged components all need to be treated as part of the same security system.

As AI agents become more capable of acting on behalf of users, vulnerabilities that allow those agents to be manipulated could become increasingly significant.

BragJack is an early example of what can happen when the boundaries between browser extensions, AI assistants, and privileged browser capabilities are not sufficiently protected.