Security researcher Gal Weizman of Forever Security has unveiled BragJack, a novel attack technique that compromises the AI assistants embedded directly into modern browsers. The proof-of-concept successfully hijacked five major Chromium-based targets, including Google Chrome’s Gemini Live, Perplexity Comet, Microsoft Edge, Opera Neon, and Anthropic’s Claude in Chrome. The findings have resulted in two new CVEs and over $20,000 in combined bug bounties, with payouts ranging from $600 to $7,000 per vendor. Both Google and Microsoft have already deployed patches to resolve the specific vulnerabilities identified in their respective browsers.

The Brain and Body Split

Weizman’s analysis highlights a fundamental architectural flaw in how browser-integrated AI systems operate, describing them as having a 'brain' (the AI model) and a 'body' (the privileged browser component). While the AI processes instructions, the privileged component executes actions like reading tabs, taking screenshots, or accessing local files. The vulnerability arises because browser extensions can manipulate web traffic that these trusted components rely on. By leveraging Chromium’s declarativeNetRequest (DNR) functionality, attackers can modify response headers and redirect resources, effectively bypassing direct injection restrictions and executing code within the AI’s trusted context.

Prompt Forcing vs. Prompt Injection

The core of the BragJack technique is what Weizman terms 'Prompt Forcing,' which differs significantly from traditional prompt injection. Instead of slipping malicious instructions into content the AI is already reading, Prompt Forcing allows an attacker to hand the agent an entire prompt and follow-up instructions directly. The agent then translates these attacker-controlled instructions into legitimate browser actions using its existing high-level privileges. This is particularly dangerous for endpoint defense because the resulting actions are performed by legitimate software, making them difficult to distinguish from normal user activity.

Specific Exploits in Chrome and Edge

In the Chrome attack, Weizman discovered that while extensions were blocked from directly touching the chrome://glic component, DNR rules could still intercept requests made by the embedded Gemini web app. By weakening security headers and redirecting a JavaScript resource, he executed code inside the Gemini context, gaining access to local files, web content, and potentially the camera and microphone. This flaw was assigned CVE-2026-0628. Microsoft Edge presented a different vector, where a race condition in its 'Think' and 'Do' mode separation allowed attackers to force a prompt and re-enable action capabilities before the agent could check its state, leading to CVE-2026-55945.

Agentic Browsers Are High-Value Targets

The implications are even more severe for agentic browsers like Perplexity Comet, where the AI can actively interact with websites rather than just reading them. Weizman demonstrated that a malicious extension could force the Comet agent to visit Perplexity, summarize the victim’s emails, and send the results to an attacker-controlled address. This capability to read browsing history, local files, and screenshots, combined with the ability to send instructions, turns a compromised extension into a powerful surveillance and automation tool. The research underscores that as browsers hand more autonomy to AI agents, the attack surface for malicious extensions expands exponentially.

Key Takeaways

  • BragJack exploits the trust boundary between browser extensions and privileged AI components using declarativeNetRequest (DNR).
  • 'Prompt Forcing' allows attackers to dictate entire workflows to AI agents, bypassing traditional content-based injection defenses.
  • The technique affects major vendors including Google (CVE-2026-0628), Microsoft (CVE-2026-55945), Perplexity, Opera, and Anthropic.
  • Users must scrutinize extension permissions and keep browsers updated, as malicious code can now leverage AI agents to read local files and act on the user's behalf.

The Bottom Line

BragJack proves that AI autonomy in browsers creates a dangerous new attack surface where malicious extensions can hijack trusted AI actions. Until vendors isolate AI execution contexts from standard web traffic, users must treat every browser extension as a potential remote controller for their digital life.