BragJack Attack Technique Hijacks AI Browser Assistants Through Malicious Extensions
Security researcher Gal Weizman of Forever Security has unveiled a sophisticated attack vector known as BragJack, which demonstrates how malicious browser extensions can seize control of AI-powered assistants integrated into modern web browsers. This vulnerability, which affects five major platforms including Google Chrome, Microsoft Edge, and Perplexity Comet, underscores the significant security risks introduced by the rapid, often permissive, integration of generative AI into the desktop computing environment.
The research, which earned more than $20,000 in combined bug bounties across five distinct vendors, exposes a fundamental architectural flaw: the disconnect between the "brain" of the AI model and the "body" of the browser’s privileged system components. By exploiting the declarativeNetRequest (DNR) functionality within Chromium-based architectures, attackers can force these AI agents to execute unauthorized commands, effectively bypassing security barriers intended to protect sensitive user data.
The Anatomy of BragJack
At the heart of the BragJack vulnerability lies the concept of "Prompt Forcing." Unlike traditional prompt injection attacks—where a malicious actor attempts to manipulate an AI’s output by injecting text into a conversation—Prompt Forcing leverages the inherent privileges granted to browser-based AI agents.
Weizman’s research categorizes browser-based AI systems into two distinct functional layers: the intelligence layer (the model) and the execution layer (the browser component). In a standard, secure deployment, the model processes instructions and the browser executes them within a sandboxed environment. However, BragJack allows an attacker to intercept the communication channel between these layers.
By utilizing a malicious extension, an attacker can manipulate network traffic to weaken security headers or redirect resource requests. This forces the browser’s AI component to communicate with a compromised context rather than its intended origin. Once this bridge is established, the attacker can issue direct, high-level commands to the AI, which the browser executes with the user’s full, authorized permissions.
A Chronology of Vulnerabilities
The discovery of BragJack follows a series of security disclosures that have highlighted the fragility of AI-driven browser plugins throughout 2026.
- April 2026: LayerX discloses "ClaudeBleed," a flaw in the Claude for Chrome extension that allowed it to trust the origin of a request without properly verifying the specific script driving the interaction.
- January 2026: Google releases a stable channel update for Chrome addressing CVE-2026-0628, a vulnerability identified by Weizman where extensions could manipulate the chrome://glic component.
- Mid-2026: Further research identifies that the Claude for Chrome extension fails to distinguish between synthetic clicks and genuine user interaction, a vulnerability that remained persistent for several software iterations.
- Late 2026: Formal disclosure of BragJack across five platforms, resulting in two distinct CVEs, including CVE-2026-55945 for Microsoft Edge.
The timeline suggests that while vendors are actively patching individual flaws, the underlying architectural pattern—placing AI agents in a position of high authority without sufficient verification of the input source—remains a systemic concern.
Analysis of Targeted Platforms
The BragJack proof-of-concept demonstrated varied degrees of success depending on the specific implementation of the browser’s AI agent.
Google Chrome and Gemini
In the case of Google Chrome, the attack targeted the privileged chrome://glic component. Despite strict security policies preventing direct script injection into Google’s primary domains, the researcher found that DNR rules could intercept requests made by the embedded Gemini web app. By redirecting a JavaScript resource, the researcher executed code within the Gemini context, gaining the ability to read local files, take screenshots, and access system hardware like microphones and cameras.
Perplexity Comet and Agentic Browsers
The attack on Perplexity Comet highlighted the risks inherent in "agentic" browsers—those capable of taking autonomous actions on behalf of the user. Weizman discovered that the browser’s agent trusted secondary testing domains that lacked the rigorous security configurations of the primary perplexity.ai site. By manipulating redirects, the attacker could inject content scripts that instructed the agent to summarize sensitive emails and exfiltrate the data to external servers, demonstrating a high-level abuse of autonomy.
Microsoft Edge and Race Conditions
Microsoft’s implementation attempted to mitigate these risks by splitting the agent into "Think" and "Do" modes. However, the researcher identified a race condition where the security restriction could be disabled momentarily by forcing a prompt. By timing the prompt correctly, the attacker could bypass the system’s "Do" restriction, enabling unauthorized actions before the browser could re-verify the state of the agent.
Industry Response and Remediation
Both Google and Microsoft have issued patches for the vulnerabilities identified under the BragJack umbrella. In a statement to industry peers, security experts have noted that these fixes are iterative rather than structural. The speed at which AI agents are being integrated into daily workflows often outpaces the development of robust, security-first frameworks for agent-browser communication.
"The issue is not necessarily the AI itself, but the ‘body’ it is given," noted one security analyst. "When you grant an AI model the power to read your emails, control your tabs, and take screenshots, you are effectively creating a high-privilege account that can be accessed by any extension with sufficient permissions."
The vendors involved have emphasized that the attack requires a prerequisite: the victim must already have a malicious browser extension installed. This places the burden of security on both the platform provider and the end user.
Broader Implications for Cybersecurity
The emergence of BragJack signals a paradigm shift in how browser-based attacks will manifest in the coming years. As AI becomes the primary interface for web interaction, the "attack surface" is moving away from malicious URLs and toward the manipulation of the AI’s intent.
The "Trust" Problem
Modern browsers rely heavily on a trust-based model for extensions. Once an extension is granted "read and change all your data on all websites" permissions, it occupies a position of significant trust. BragJack demonstrates that this trust is currently being exploited to bypass modern security features, including Content Security Policies (CSP) and cross-origin protections.
Recommendations for Users and Organizations
Given the potential for data exfiltration and unauthorized system control, security professionals are advising a tiered approach to risk management:
- Strict Extension Auditing: Users and IT departments should perform regular audits of installed extensions. Any extension that requests broad permissions should be treated as a potential vector for compromise.
- Zero-Trust Browser Configurations: Organizations should consider disabling the use of third-party extensions on enterprise-managed devices to prevent the installation of potentially malicious code.
- Vigilance with AI Agents: Users should be cautious when granting AI agents access to sensitive web applications, such as corporate email, financial platforms, or cloud storage, particularly if those agents operate with "agentic" or autonomous capabilities.
- Software Lifecycle Management: Keeping browsers and extensions updated to the latest versions is critical, as many of the vulnerabilities identified in 2026 were only remediable through security patches that modified the underlying browser architecture.
Conclusion
The BragJack research serves as a critical warning for both software developers and end users. While AI integration offers undeniable productivity benefits, it has also introduced a new class of vulnerabilities that traditional endpoint security measures are ill-equipped to handle. As the industry moves toward more autonomous web agents, the development of hardened, verification-first architectures will be essential to ensure that the "brain" of the AI remains under the user’s control, rather than becoming a puppet for malicious actors. The $20,000 in bounties paid out to Weizman underscores the severity of the threat and the commitment of major vendors to remediating these flaws as they are discovered. However, the persistence of similar vulnerabilities across multiple releases suggests that the security community must remain hyper-vigilant as the landscape of AI-enhanced browsing continues to evolve.
