BragJack: One Browser Extension Can Silently Hijack Your AI Assistant

Security researcher Gal Weizman of Forever Security published a proof-of-concept attack on September 16 that should make every person using an AI assistant in their browser pause. He called it BragJack. It demonstrates how a single malicious browser extension — the kind you might install thinking it’s a productivity tool or an ad blocker — can silently take control of the AI assistant built into your browser and use it to read your emails, access your files, take screenshots, and send sensitive data to an attacker. Without any further interaction from you.

The attack works against five major Chromium-based browsers and assistants: Google Chrome’s Gemini Live, Microsoft Edge, Opera Neon, Perplexity Comet, and Claude in Chrome. Google and Microsoft have issued patches. The others received bounties but have no confirmed fix date for every attack path Weizman found.

What BragJack Actually Does — and How

Most people have heard of prompt injection — hiding malicious instructions in a webpage or document to manipulate an AI’s responses. BragJack is different. It bypasses that layer entirely.

Weizman calls his technique Prompt Forcing. Instead of sneaking instructions into content the AI reads, the malicious extension intercepts the trusted communication channel between the browser’s AI assistant and the vendor-controlled server it takes instructions from. The extension impersonates that trusted origin — making the AI think its instructions are coming from Google, Microsoft, or Anthropic — and issues its own commands directly.

The extension does this using declarativeNetRequest — the same browser API that ad blockers use to filter web traffic. It’s a permission that millions of people grant to extensions without a second thought. When paired with access to all HTTPS sites, it gives the extension the ability to intercept and redirect network requests before the AI assistant even sees them.

Once in control, the hijacked AI assistant acts on the attacker’s instructions using its own legitimate browser privileges. In Weizman’s proof-of-concept, he instructed hijacked agents to summarise the victim’s emails and send them to an external address. No clicks required. No alerts triggered. The assistant just does what it’s told — because it believes the instructions come from the vendor.

How Each Browser Was Exploited Differently

The attack manifested differently across the five targets, which illustrates how many distinct architectural decisions can lead to the same vulnerability class.

Chrome / Gemini Live: Chrome blocked extensions from injecting scripts into Gemini’s page, but didn’t prevent an extension from modifying the network requests used to load Gemini. Weizman substituted JavaScript from his own site, giving him control of Gemini’s browser-side logic. This allowed screenshots, local file access, and camera/microphone activation — without any user clicks. Google assigned this CVE-2026-0628 (CVSS 8.8) and fixed it in Chrome 143.

Microsoft Edge: Edge used separate “Think” and “Do” modes to keep instruction processing and browser actions apart. Weizman found a race condition that briefly disabled the restriction while forcing a prompt, then re-enabled the action capability before the agent checked its state. Microsoft assigned CVE-2026-55945 (CVSS 4.2) and patched it in Edge 150.

Perplexity Comet: Described as the most severe case. Comet’s AI agent had broad browser permissions, and Weizman found a testing domain — testing.perplexity.com — that was still authorised to issue commands to the agent in production. An extension could suppress the redirect to the main Perplexity site, load the testing page in the background, and inject code through it.

Claude in Chrome: Although Claude in Chrome is itself an extension rather than a native browser feature, a trusted Anthropic-controlled page could still send messages to the assistant. That trust relationship was exploitable by another extension targeting the same trusted origin.

What You Need to Do Right Now

The core fixes from Google and Microsoft are already deployed. But the broader lesson is about extension hygiene — a habit most people skip entirely.

• Update Chrome and Edge immediately. If you haven’t applied recent updates, the CVE patches are waiting. Open your browser, go to Settings → About, and let it update.
• Audit your browser extensions now. Go to your extensions page and look at every extension installed. If you don’t recognise it, don’t remember installing it, or haven’t used it in months, remove it. Pay particular attention to extensions that requested permission to “read and change all your data on all websites” — that’s the permission BragJack relies on.
• Treat AI browser assistants as high-privilege features. If you’re using Gemini Live, Claude in Chrome, or Perplexity Comet on a device that handles sensitive work, disable the assistant when not actively using it — especially on devices where you can’t fully control which extensions are installed.
• For organisations: Enterprise browser management policies that restrict which extensions employees can install are the most durable fix. The CVE patches close Weizman’s specific findings. They don’t change the underlying architecture that made all five assistants vulnerable through the same technique.

BragJack is a proof-of-concept, not a confirmed active attack campaign. But the technique is documented, the code is public, and the vulnerable architecture — AI assistants with elevated browser privileges, trusting vendor-controlled origins, accessible via the same extension APIs as ad blockers — is not going away overnight. For more on the evolving AI attack surface, see our guide on protecting yourself from AI-powered cyber threats.

Read more tech related articles here.