Gal Weizman, a security researcher at Forever Security, has revealed an attack method that exploits how AI assistants are integrated into modern browsers. Dubbed BragJack, the technique demonstrates how a single malicious extension can commandeer AI agents across multiple platforms, including Google Chrome's Gemini Live, Perplexity Comet, Microsoft Edge, Opera Neon, and Anthropic's Claude in Chrome.

The research generated more than $20,000 in combined bug bounties from the affected vendors, with individual payouts ranging from $600 to $7,000, and resulted in two CVE assignments. The attack hinges on having the malicious extension already present in a victim's browser, after which it can operate silently and grant the extension control over the AI agent's capabilities to extract confidential information or perform actions as the user.

Both Google and Microsoft have already patched the vulnerabilities identified in their respective products.

Exploiting the Architecture of Browser-Integrated AI

The vulnerability stems from how modern browsers architect their AI systems. Weizman characterizes these systems as having a "brain" and a "body"—the AI model processes commands and determines what actions to take, while a privileged browser component executes those actions, such as accessing tabs, capturing screenshots, or interacting with web pages.

The core issue is that browser extensions can intercept and modify web traffic and pages that these privileged components rely on and trust. Across all five targeted platforms, the same extension exploited Chromium's declarativeNetRequest (DNR) feature, which allows extensions to control how network requests are processed, including modifying response headers and redirecting resources.

In the Chrome attack, Weizman demonstrated that although extensions cannot directly access the privileged chrome://glic component or inject scripts into Google's Gemini interface, DNR rules could still intercept requests from the embedded Gemini application. By weakening security headers and redirecting a JavaScript resource, he injected code into the Gemini context that communicated directly with Chrome's privileged AI component, bypassing Gemini's standard request handling.

This access granted the ability to read local files, access web content, capture screenshots, and potentially reach the browser's camera and microphone. Google assigned CVE-2026-0628 to this finding and awarded a $7,000 bounty.

From Data Extraction to Agent Control

Attacks targeting agentic browsers like Perplexity Comet and Opera Neon proved more severe, as these agents can modify websites rather than simply read them. For Comet, Weizman identified that the browser's built-in agent extension trusted multiple Perplexity domains, including a testing domain that lacked the same security measures as the primary perplexity.ai site. By removing a DNR redirect to that domain, he loaded it and injected a content script capable of communicating with the built-in agent.

The resulting compromise included access to browsing history, screenshots, local files, and the ability to send commands to the agent. Weizman demonstrated forcing the agent to visit Perplexity, summarize the victim's emails, and transmit the results to an external address.

Microsoft Edge presented a distinct vulnerability. Microsoft had implemented "Think" and "Do" modes to prevent the agent from accepting arbitrary instructions and performing actions simultaneously. Weizman discovered a race condition that momentarily disables this restriction while forcing a prompt, then re-enables action capability before the agent verifies its state. Microsoft assigned CVE-2026-55945 to this race condition.

Comparable flaws were identified in Opera Neon and Claude in Chrome, though Claude in Chrome functions as a browser extension rather than a built-in browser feature. Earlier this year, research from Manifold Security identified a related weakness in Claude for Chrome: the extension executed its AI workflows on synthetic clicks without confirming they originated from an actual user, and the vulnerable code remained reproducible across eight subsequent releases.

This discovery followed ClaudeBleed, an earlier vulnerability in the same extension disclosed by LayerX in April, in which Claude for Chrome trusted the claude.ai origin without verifying which script was actually controlling it.

Prompt Forcing: A New Attack Vector

Weizman terms the technique used to compromise these agents Prompt Forcing. Unlike conventional prompt injection, where attackers embed malicious instructions into content an AI is processing, Prompt Forcing allows the attacker to deliver an entire prompt and subsequent instructions directly to the agent. The agent then interprets these instructions as legitimate browser actions using its existing privileges.

This distinction carries significant implications for endpoint security, according to the researcher, because the final action is not executed by traditional malware code. Instead, legitimate software is being instructed to carry out the attack.

BragJack highlights an emerging challenge as browsers and endpoint applications integrate increasingly sophisticated AI agents. A compromised extension that would ordinarily access only web content can, depending on system design, become a gateway to software capable of reading files, accessing browsing data, and performing actions on websites on the user's behalf.

Mitigation Recommendations

  • Keep browsers updated to the latest version
  • Remove extensions that are unrecognized or no longer in use
  • Exercise caution when granting extensions broad permissions such as "read and change all your data on all websites"

In addition to his detailed writeup, Weizman has made available a comprehensive technical analysis covering all five attack scenarios.