Clarissa Hana
Security researcher Gal Weizman of Forever Security has unveiled a sophisticated new attack technique, dubbed BragJack, capable of compromising the integrated AI assistants within popular web browsers. This vulnerability, demonstrated through a proof-of-concept, allows a single malicious browser extension to seize control of these advanced AI functionalities. The research, which has already netted over $20,000 in bug bounties from affected vendors and resulted in the assignment of two Common Vulnerabilities and Exposures (CVEs), highlights a significant emerging threat vector as AI becomes increasingly embedded in user-facing software.
The BragJack attack primarily targets Chromium-based browsers and their AI assistants, with Weizman successfully demonstrating its efficacy against Google Chrome’s Gemini Live, Perplexity Comet, Microsoft Edge, Opera Neon, and Anthropic’s Claude integration within Chrome. The core requirement for the attack is the prior installation of a malicious browser extension on the victim’s system. Once this prerequisite is met, the attack can proceed without any further user interaction. This means an extension could potentially commandeer a browser’s AI agent, leveraging its existing privileges to access sensitive user data, execute actions on behalf of the user, or both. Both Google and Microsoft have acknowledged and addressed the specific vulnerabilities attributed to their products, issuing patches to mitigate the risks.
The Mechanics of Abusing Trusted Browser Components
The BragJack exploit capitalizes on the growing trend of deeply integrating AI assistants into web browsers, granting them extensive browser-level capabilities. Weizman’s detailed analysis, published on the Forever Security blog, conceptualizes these AI systems as comprising a "brain" and a "body." The AI model, acting as the brain, processes instructions and determines the appropriate course of action. The "body" is a privileged browser component that executes these actions, which can include accessing open tabs, reading the content of web pages, capturing screenshots, or directly interacting with websites.
The critical vulnerability, according to Weizman, lies in the capacity of browser extensions to manipulate web traffic and pages that these trusted, privileged components interact with. The same malicious extension was employed across all five targeted platforms, ingeniously utilizing Chromium’s declarativeNetRequest (DNR) functionality. DNR is a powerful API that empowers extensions to modify how network requests are handled, offering capabilities such as altering response headers and redirecting resources.
In the case of Google Chrome’s Gemini Live, Weizman discovered that while direct manipulation of privileged components like chrome://glic or script injection into Google’s Gemini site was prevented, DNR rules could still intercept requests originating from the embedded Gemini web application. By strategically weakening security headers and redirecting a critical JavaScript resource, the attacker could execute code within the Gemini context. This allowed direct communication with Chrome’s privileged AI component, bypassing the standard request flow of the Gemini web app. The implications of such access are far-reaching, potentially enabling the reading of local files, accessing web content, capturing screenshots, and even gaining control over the browser’s camera and microphone. Google assigned the vulnerability CVE-2026-0628 and awarded a $7,000 bounty for its discovery.
Escalating from Data Reading to Full AI Agent Control
The BragJack attacks extend beyond mere data exfiltration in agentic browsers like Perplexity Comet and Opera Neon. These browsers feature AI agents designed to actively interact with websites, not just passively read their content. For Perplexity Comet, Weizman identified that the browser’s built-in agent extension implicitly trusted several Perplexity domains, including a testing domain that lacked the robust security protections afforded to the primary perplexity.ai site. By using DNR to remove a redirect to this less secure testing domain, Weizman was able to load it and inject a content script. This script could then communicate directly with the built-in AI agent.
The compromised access granted by this exploit included sensitive user information such as browsing history, screenshots, and local files. Crucially, it also enabled the attacker to send instructions to the agent. Weizman’s proof-of-concept demonstrated the ability to force the agent to visit Perplexity, summarize a victim’s emails, and then transmit these summaries to an attacker-controlled email address. This represents a significant escalation from passive data theft to active manipulation of user accounts and communications.
Microsoft Edge presented a unique challenge due to its architectural design, which separates its AI agent into "Think" and "Do" modes. This segmentation was intended to prevent the agent from simultaneously accepting arbitrary instructions and executing actions. However, Weizman uncovered a race condition within this system. By exploiting a brief window where the restriction was disabled during a forced prompt, the attacker could re-enable the action capability before the agent’s state was re-evaluated. Microsoft has assigned CVE-2026-55945 to this race condition vulnerability.
Similar vulnerabilities were identified and demonstrated against Opera Neon and Anthropic’s Claude integration within Chrome. It is noteworthy that Claude for Chrome operates as a browser extension itself, rather than being a core browser feature. This discovery follows related findings concerning the Claude for Chrome extension. Earlier in the year, research conducted at Manifold Security by this author identified a related weakness where the Claude for Chrome extension executed its built-in AI workflows based on synthetic clicks, without verifying if these originated from a genuine user. This flagged code remained reproducible for at least eight subsequent releases. Prior to that, in April, LayerX disclosed "ClaudeBleed," another flaw in the same extension that permitted Claude for Chrome to trust the claude.ai origin without verifying the script initiating the request.
The "Prompt Forcing" Technique
Weizman has coined the term "Prompt Forcing" to describe the core technique employed in these attacks. This method distinguishes itself from conventional prompt injection, where attackers attempt to embed malicious instructions within content that an AI is already processing. Prompt Forcing, conversely, allows an attacker to directly furnish the AI agent with an entire prompt and subsequent instructions. The AI agent then interprets these instructions and translates them into legitimate browser actions, leveraging its pre-existing permissions.
This distinction is particularly significant for endpoint security solutions. In a BragJack attack, the final malicious action is not executed by conventional malware but is instead initiated by the browser’s own legitimate software, acting under duress. This presents a challenge for traditional security measures that are often designed to detect and block suspicious code execution rather than legitimate code being instructed to perform malicious acts.
The BragJack findings underscore a mounting security concern as browsers and other endpoint applications increasingly incorporate more sophisticated AI agents. A compromised browser extension, which historically might have been limited to observing web content, can now, depending on the specific implementation, serve as a gateway to software that can access and exfiltrate sensitive files, browsing data, and even actively manipulate websites on behalf of the user.
Broader Implications and User Recommendations
The implications of the BragJack attack extend beyond the immediate vulnerabilities discovered. It signals a fundamental shift in the threat landscape, where the integration of AI into everyday software introduces new attack surfaces and methods. As AI agents become more powerful and autonomous, the potential for misuse by malicious actors grows proportionally. The ability to leverage an AI assistant’s existing privileges for nefarious purposes bypasses many traditional security controls, demanding a re-evaluation of how we secure these increasingly intelligent software components.
For end-users, the findings necessitate a heightened awareness of browser security practices. Keeping browser software and extensions consistently updated is paramount, as vendors like Google and Microsoft have demonstrated a commitment to patching these vulnerabilities. Users are also strongly advised to regularly review and remove any browser extensions they do not recognize or no longer actively use. Furthermore, the practice of granting broad permissions, such as "read and change all your data on all websites," should be approached with extreme caution. Such extensive permissions can provide attackers with a powerful toolkit if the extension is compromised or malicious.
Weizman has provided comprehensive resources for those seeking a deeper understanding of the BragJack attack. In addition to his initial write-up, a full technical breakdown detailing each of the five demonstrated attacks is available, offering in-depth insights into the methodologies employed.
The research also serves as a critical reminder for developers and security professionals. The trend towards embedding AI agents with extensive capabilities requires a rigorous security-by-design approach. Future development must prioritize robust authentication, input validation, and a principle of least privilege for AI components. The potential for prompt forcing and similar techniques means that simply trusting the source of an instruction is no longer sufficient; the context and legitimacy of the action itself must be continuously verified. As AI permeates more aspects of our digital lives, understanding and mitigating these novel attack vectors will be crucial in maintaining a secure digital environment.
