BragJack Hijacks AI Agents Built Into Five Browsers

A browser extension could hijack the AI agents built into five major browsers without bypassing a single model guardrail or writing one injected prompt, provided the extension was already installed and granted broad site permissions, researcher Gal Weizman of Forever Security disclosed Sept. 16.

Weizman's write-up, published on Forever Security's blog, names the technique BragJack and lists five targets: Google Chrome's Gemini assistant, Microsoft Edge's Copilot, Opera Neon, Perplexity Comet and Anthropic's Claude in Chrome extension. The research produced more than $20,000 in combined bounties from the five vendors and two formally tracked vulnerabilities, BleepingComputer reported.

A technique that skips prompt injection entirely

Every browser agent Weizman tested splits into two halves: a "body" inside the browser that can screenshot tabs, read local files and reach the camera and microphone, and a "brain" hosted on the vendor's own servers that decides what the body should do next. Extensions cannot script the brain's website directly in a fully hardened browser, so Weizman instead abused Chromium's declarativeNetRequest API, which lets an installed extension rewrite network requests, to swap the brain's own JavaScript for a file hosted on his own server. He calls the resulting control "Prompt Forcing": rather than smuggling malicious text into an existing prompt, the extension writes and sends an entirely new one, then issues follow-up commands of its own.

Chrome's fix traces back to a January disclosure

Google's fix for the Gemini flaw, tracked as CVE-2026-0628 and rated 8.8 on the CVSS scale, shipped in Chrome 143.0.7499.192 and carries a January 2026 publication date in the National Vulnerability Database, since Weizman first disclosed the Chrome finding separately earlier in the year under the name GlicJack before folding it into the wider BragJack write-up. Google paid $7,000 for it, the largest single bounty of the five and a separate class of flaw from the sixth Chrome zero-day Google patched in 2026, which lived in the browser's V8 engine rather than in an AI assistant's own permission model.

Edge closed a race condition between two safety modes

Microsoft's browser agent normally allows only one mode at a time: "Think," where it receives instructions, or "Do," where it executes them, a separation meant to stop a hijacked instruction stream from acting immediately. Weizman found he could put the agent into Think mode, feed it commands, then switch it to Do mode while those commands were still being processed. Microsoft tracked the flaw as CVE-2026-55945, a race condition rated 4.2 on the CVSS scale, and fixed it in Edge versions before 150.0.4078.48, according to NVD's own record.

Claude in Chrome and Perplexity Comet had no CVE at all

Opera, Anthropic and Perplexity fixed their respective flaws without a formally tracked CVE number, Weizman's write-up and BleepingComputer's reporting both show. Anthropic classified its own Claude in Chrome flaw as medium severity; Weizman describes it as the least dangerous of the five because the exploit involved one browser extension attacking another, rather than an extension reaching into the browser's own privileged code. Perplexity's Comet browser, which Weizman calls the worst of the five because its agent runs with the browser's full permission set, let an extension read any file on the operating system with no clicks required.

Browser or assistant	Vendor	Tracked CVE	Bounty
Chrome (Gemini)	Google	CVE-2026-0628 (CVSS 8.8)	$7,000
Edge (Copilot)	Microsoft	CVE-2026-55945 (CVSS 4.2)	Undisclosed
Claude in Chrome	Anthropic	None assigned	$600
Opera Neon	Opera	None assigned	Undisclosed
Perplexity Comet	Perplexity	None assigned	Undisclosed

The research lands as browser makers race to ship agentic assistants without a shared standard for what an extension should be allowed to do to them, a gap Anthropic's own fourth disclosed AI security incident already illustrated from the model side rather than the browser side. Weizman's advice to users in the meantime is the least glamorous kind: audit installed extensions for permissions to "read and change all your data on all websites," and remove anything that does not need it.