BragJack Vulnerabilities Allow Browser Extensions to Hijack AI Agents

A newly disclosed attack technique dubbed BragJack demonstrates how a single malicious browser extension can completely hijack AI browser agents across major web browsers. By abusing Chromium’s native request manipulation APIs, researcher Gal Weizman of Forever Security uncovered flaws—including CVE-2026-0628 in Google Chrome and CVE-2026-55945 in Microsoft Edge—that enable extensions to silently commandeer built-in AI assistants without user interaction. The attack methodology, termed Prompt Forcing, bypasses standard browser isolation boundaries and allows malicious extensions to abuse the heightened privileges assigned to native AI integrations.

Anatomy of the BragJack ‘Prompt Forcing’ Attack

Modern browser AI integrations rely on a dual-component architecture: an AI model functioning as the logical “brain” that processes user requests, paired with a highly privileged browser component acting as the “body” that performs physical actions across the DOM, network stack, and local file system. Under standard operation, the privileged body reads active tabs, takes screen captures, queries browsing histories, and interacts with web forms on the user’s behalf.

BragJack subverts this architecture not by tricking the language model through indirect prompt injection inside web page content, but through “Prompt Forcing.” Once installed, a malicious extension uses Chromium’s declarativeNetRequest (DNR) API to manipulate network traffic, drop restrictive response headers, and redirect key JavaScript resources loaded by the browser’s internal AI interfaces. Because these internal AI components inherently trust their underlying browser origins, injected content scripts gain direct communication channels to the privileged “body” of the agent. The attacker effectively hands the AI agent a complete prompt and action sequence, causing the browser itself to execute malicious instructions under the guise of legitimate user intent.

How Specific AI Browsers and Assistants Were Bypassed

Weizman’s proof-of-concept targeted five distinct Chromium-based platforms and AI extensions, earning over $20,000 in bug bounties:

• Google Chrome (Gemini Live): Extensions are normally prohibited from interacting directly with Chrome’s internal chrome://glic component or injecting scripts into Google’s Gemini domain. However, Weizman used DNR rules to intercept network requests made by the embedded Gemini web app, weakening security headers and swapping out a JavaScript dependency. This allowed arbitrary code execution within the Gemini execution context, granting direct access to Chrome’s privileged AI component to read local files, inspect tab contents, capture screenshots, and potentially access peripheral devices like the camera and microphone. Google resolved the underlying issue under CVE-2026-0628 with a $7,000 bounty payout.
• Microsoft Edge: Microsoft attempted to mitigate agentic risk by separating its AI agent into distinct “Think” (reasoning) and “Do” (action execution) modes to prevent simultaneous instruction processing and autonomous action. Weizman identified a race condition in this enforcement logic, briefly forcing a prompt while the restrictions were temporarily disengaged and re-enabling action execution before the agent verified its current state. Microsoft addressed this flaw under CVE-2026-55945.
• Perplexity Comet: The agent extension natively trusted several Perplexity subdomains, including an internal testing origin that lacked the security controls applied to perplexity.ai. By stripping out redirect logic using DNR, the exploit loaded the under-protected domain and injected a content script directly into the agent’s context. This granted full control over the agent, enabling an attacker to command the browser to query local files, summarize private emails, and automatically exfiltrate the summarized text to an external email address.
• Opera Neon and Anthropic Claude in Chrome: Similar trust boundary compromises were demonstrated against Opera Neon and Anthropic’s Claude in Chrome extension. The Claude extension has faced repeated scrutiny regarding origin verification, having previously suffered from the “ClaudeBleed” vulnerability disclosed by LayerX and synthetic click validation flaws identified by Manifold Security.

The Blast Radius of Agentic AI Exploitation

The transition from passive browser assistants to fully autonomous, agentic AI assistants drastically alters the blast radius of browser extension compromises. Historically, a rogue browser extension was limited to the permissions explicitly granted by the user, such as reading web traffic or modifying web pages across specified domains.

Prompt Forcing shifts this boundary entirely. When an extension hijacks a built-in AI agent, it inherits the broad system-level and browser-level capabilities granted to that agent. A compromised extension no longer needs to implement complex local data harvesting routines or bypass endpoint protection software; it simply instructs the trusted, signed browser agent to perform file access, email summarization, and credential usage on its behalf. Because the final malicious actions are executed by native, benign binaries, endpoint detection and response (EDR) platforms and browser defense mechanisms fail to flag the activity as anomalous.

Mitigation and Enterprise Defensive Actions

Both Google and Microsoft have issued updates resolving CVE-2026-0628 and CVE-2026-55945, respectively, alongside patches deployed by Perplexity, Opera, and Anthropic. Organizations deploying Chromium-based browsers should take immediate corrective steps:

1. Enforce Immediate Browser Updates: Ensure all Google Chrome and Microsoft Edge browser instances are updated to versions containing the vendor fixes for CVE-2026-0628 and CVE-2026-55945.
2. Restrict Extension Installation: Utilize Group Policy or MDM profiles (ExtensionInstallBlocklist in Chrome and Edge) to restrict browser extension installations strictly to an approved enterprise allowlist.
3. Audit Extension Permissions: Security teams should audit installed browser extensions for the use of the declarativeNetRequest, declarativeNetRequestWithHostAccess, or <all_urls> permission scopes, as these provide the structural capabilities required to alter network responses and bypass frame isolation controls.