BragJack: When a Browser Extension Takes the Wheel of Your AI Assistant
Your AI browser assistant is supposed to be the helpful one. It reads the page, fills the form, checks your calendar, and only does what you ask. A new attack technique called BragJack shows what happens when someone else gets to ask on your behalf.
The name comes from the concept of hijacking the trusted channel between an AI assistant and the privileged part of the browser it controls. Researcher Gal Weizman of Forever Security demonstrated it across five Chromium-based environments: Chrome, Microsoft Edge, Opera Neon, Perplexity's Comet, and Claude in Chrome. One malicious extension, a handful of browser-specific rules, and the assistant becomes an attacker's puppet.
This is not another prompt injection story. It's worse in a quiet way, and it changes what "AI browser security" has to mean for anyone rolling these tools out to a team.
The architecture nobody thinks about
Every AI browser assistant is really two things stitched together. There's a brain, usually a model hosted on a vendor-controlled website, and a body, the powerful component inside the browser that can inspect pages, click, type, read local files, and act on sites you're already signed into.
The brain and the body talk over a channel that both sides treat as trusted. The body accepts instructions because they appear to arrive from the vendor's own origin.
That trust is the whole security model. And it turns out the trust is negotiable.
A malicious extension can manipulate that origin, or a page already authorized to talk to the agent, and then issue its own instructions as if the browser vendor sent them. Weizman calls the technique prompt forcing, to separate it from prompt injection. In prompt injection, hostile text is smuggled inside content the model reads. In prompt forcing, the attacker controls the entire prompt, the timing, and every follow-up command, and the model never gets to weigh in on whether it should have received them.
That last part matters. Model-level safety filters can't correct an isolation failure that happens before the model is even consulted. You can't prompt-engineer your way out of a broken trust boundary.
What the attackers actually got
The impact varied by browser, and the range is a good map of how much power these assistants quietly hold.
On Chrome, Google's Gemini integration blocked content-script injection into its embedded web app but failed to stop declarativeNetRequest rules from intercepting resources loaded inside the privileged WebView. The researchers replaced a legitimate JavaScript resource, executed code inside Gemini's trusted context, and gained the ability to read local files, capture screenshots, expose profile information, and switch on the camera and microphone. Google tracked it as CVE-2026-0628, rated 8.8, and fixed it in Chrome 143.0.7499.192/.193.
On Comet, the impact was broadest. Perplexity's agent trusted several Perplexity origins, including an unprotected testing domain. The extension stripped that domain's redirect header, injected a content script, and spoke directly to the agent. The result: browsing history, screenshots, profile leakage, local file reads, and autonomous activity on authenticated websites, all while the user saw a normal session.
On Opera Neon, code running on opera.com could send arbitrary prompts to the agent.
On Edge, Microsoft had separated prompt intake from browser actions with distinct "Think" and "Do" modes, which is genuinely good design. The researchers got around it with a race condition, flipping modes at the right moment so the agent executed a forced prompt. Microsoft assigned CVE-2026-55945 and patched it in Edge 150.0.4078.48 and later.
On Claude in Chrome, the story was extension-on-extension. A Claude marketing page was permitted to pass prompts to the side panel; the researchers abused that path and then manufactured the click-through debugger privileges the assistant expected. One extension undermined another through an exposed privileged messaging interface.
The honest caveat
BragJack requires a malicious extension to be installed first. "Zero click" here describes exploitation after installation, not a compromise that arrives out of nowhere. The researchers reported no in-the-wild attacks, and the vendors paid roughly $20,000 in combined bounties and patched most of the issues.
So this is not a five-alarm fire in your production environment. It is something more useful: a demonstration of where the trust lines actually sit, published before someone with worse intentions finds the same gaps.
Why this matters more than the CVE list
Organizations are handing browsers more authority than they hand most SaaS apps. An AI assistant in a corporate browser can read files on disk, see internal dashboards, operate ticketing and email, and act inside authenticated sessions. It does this with the user's identity and with the browser's reputation.
That combination is exactly what makes it a target. A compromised assistant is not just a data leak. It's a trusted insider that never took a coffee break, operating from a domain your proxies and reputation checks already allow.
There's also a measurement problem. Traditional endpoint and network telemetry has no idea an AI agent is doing something. It looks like a browser, doing browser things, from a device the user owns.
What to do this week
- Patch the browsers. Update Chrome to 143.0.7499.192 or later and Edge to 150.0.4078.48 or later. If you run Comet, Opera Neon, or Claude in Chrome, make sure the assistant components are current too.
- Enforce extension allowlists. This is the single highest-leverage control, because the attack starts with an installed extension. Allowlist by extension ID, and treat broad host permissions and declarativeNetRequest access as privileged, not routine.
- Scrutinize debugger access. Debugger permissions are effectively root inside a browser tab. Few business extensions need them.
- Treat AI-agent activity as its own telemetry source. Correlate prompts and browser actions with identity, data-access, and network logs. The signal you're hunting for isn't malware. It's trusted software behaving outside the user's expected workflow.
- Apply least privilege to the assistant itself. Sensitive actions should require explicit confirmation, and command channels should be isolated so a non-vendor origin can never speak on the vendor's behalf.
The takeaway for our clients
If you're piloting AI browsers across a team, the rollout plan matters as much as the model choice. Ask the vendor how the brain-to-body channel is authenticated, what origins are allowed to send prompts, and whether there's an audit trail an analyst can actually read. If those answers are vague, that's your risk register entry.
We build AI into client software every week, and BragJack is the reminder we keep coming back to: the interesting failures aren't in the model. They're in the seams between components that each assumed the other side was trustworthy.
Audit the seams.