BragJack: One Extension Hijacks Five Browser AI Agents

One browser extension. Five AI agents. Complete control. That is what Forever Security researcher Gal Weizman demonstrated on September 16 with a proof-of-concept he calls BragJack. A single malicious extension takes over the built-in AI assistants in Google Chrome, Microsoft Edge, Opera Neon, Perplexity Comet, and Claude in Chrome — no zero-day required, no exotic permissions requested. The extension looks like a productivity tool. It behaves like one too, right up until it hands your AI agent to an attacker.

What Is Prompt Forcing? #

You have probably read about prompt injection — hiding malicious instructions in web content to manipulate an AI’s responses. BragJack is not that. Weizman’s technique, which he calls Prompt Forcing, bypasses the content layer entirely. The attacker does not slip a rogue instruction into a document the AI reads. They write the entire prompt, control when it executes, and chain follow-up commands at will. The model cannot be “on guard” because it never sees untrusted content — it only sees instructions that appear to come from the trusted browser context.

That distinction matters. Every guide to securing AI systems from prompt injection is largely irrelevant here. This is a different threat model, and it requires a different response.

How the Extension Gets In #

The attack exploits two standard Chromium extension capabilities that millions of extensions already have: content scripts and the declarativeNetRequest (DNR) API. Content scripts run JavaScript in any page’s context. DNR — the same API ad blockers use to strip tracking headers — can intercept and modify network requests.

Combined, they let the extension strip Content-Security-Policy headers from the AI agent’s pages, then redirect JavaScript resource fetches to attacker-controlled code. That code executes inside the AI agent’s privileged context. At that point the attacker has a direct line to the agent and can issue any prompt they want. Nothing about this requires suspicious permissions. An extension asking for content scripts and DNR access in 2026 is so common that extension store reviewers barely flag it.

What an Attacker Actually Gets #

The proof-of-concept demonstrated: local file reads, full screen captures, browsing history, email summaries exfiltrated to an external endpoint, camera and microphone activation — all without triggering any additional user confirmation. Browser AI agents operate with full user-level privilege across every authenticated session. They inherit your email, your GitHub access, your internal tooling, your SaaS credentials. The agent is not a chatbot. It is a delegation of your identity.

Weizman’s original disclosure put the potential exposure at hundreds of millions of users — anyone running any of the five affected browsers with at least one extension installed and an AI agent feature enabled.

The CVEs and What Is Actually Fixed #

The research produced two CVEs and over 0,000 in bug bounties from Google, Microsoft, Anthropic, Perplexity, and Opera.

• CVE-2026-0628 (CVSS 8.8, High) — Chrome WebView policy bypass, patched in Chrome 143.0.7499.192

• CVE-2026-55945 (CVSS 4.2, Medium) — Edge race condition, patched in Edge 150.0.4078.48 Anthropic patched the specific weakness in Claude in Chrome after a 00 bounty. Opera and Perplexity issued their own fixes. A detailed technical breakdown of each attack vector is available in the DEV Community writeup.

But the patches address the specific code paths Weizman found. They do not change the fact that Chromium extensions with content scripts and DNR access can, in principle, reach browser-embedded AI agents. The architecture that made BragJack possible — AI agents sharing a trust boundary with extensions — still exists. Weizman found five doors. Vendors closed five doors. The wall itself has not changed.

What You Should Do Right Now #

Three steps, doable in under ten minutes:

1. Update your browser. Chrome 143.0.7499.192+ and Edge 150.0.4078.48+ carry the patches. Checkchrome://settings/help oredge://settings/help to confirm your version.
2. Audit your extensions. Openchrome://extensions and remove anything you do not recognize or no longer actively use. Any extension with broad host permissions or DNR access that you cannot explain by its stated purpose is a candidate for removal.
3. Scope your AI agent sessions. If your main browser profile combines a browser-embedded AI agent with work email, GitHub, and internal tools, consider a separate profile for AI-assisted work. A narrower blast radius matters when the threat model includes lateral movement across authenticated sessions.

Enterprise teams should add extension allowlisting to Chrome or Edge management policies via the Chrome Enterprise admin console and explicitly define which AI agent features are permitted on managed devices.

The Bigger Problem #

BragJack is a preview. Browsers are adding more agentic capabilities — booking, executing code, managing files, taking autonomous actions across the web — and the extension permission model is not keeping pace. The Dark Reading analysis of BragJack frames it plainly: this is the inevitable result of embedding high-privilege agents in a platform designed for untrusted code.

Expect more research, more CVEs, and eventually a redesigned extension isolation model that properly separates agent trust from extension trust. Until browsers ship that redesign, the practical path is fewer extensions and aggressive patch hygiene. The five CVEs from BragJack are closed. The class of vulnerability is not.