BragJack: Prompt-Forcing In-Browser AI Agents via Browser Extensions

#

1. Basic Information

• Original Title: BragJack [Technical Overview]: How We Hijacked Top 5 Browsers' Internal Agents With Just One Single Extension

- Source: Forever Security
- Published Date: 2026-09-16
- Updated Date: None
- Severity: High

• Basis of Severity: Researchers demonstrated that across five environments—Chrome with Gemini, Edge with Copilot, Opera Neon, Perplexity Comet, and Claude in Chrome—an installed extension with the necessary permissions could retrieve data or control an agent, depending on the product, without further user interaction. Dark Reading reports that the issues have been resolved by the respective vendors. The cited sources do not report exploitation in the wild.
• Original Link: BragJack Technical Overview: How We Hijacked Top 5 Browsers' Internal Agents With Just One Single Extension
• Related Sources: Forever Security: BragJack overview ,Dark Reading: BragJack Attack Can Turn a Browser's Agentic AI Against It ,Google: Affected versions for CVE-2026-0628 ,Microsoft: Affected versions for CVE-2026-55945
• Related Entities: CVE-2026-0628, CVE-2026-55945, Google Chrome, Gemini Live, Microsoft Edge, Copilot, Opera Neon, Perplexity Comet, Claude in Chrome

#

2. Executive Summary

BragJack is an attack that intercepts the communication and command channels of in-browser AI agents using an already installed malicious extension. It includes pathways to directly invoke privileged functions and pathways to force-send prompts to manipulate the AI.

#

3. Attack Flow

Flow 1: Chrome and Gemini: From Traffic Modification to Direct Privilege Control

1. Researchers installed an extension with the Declarative Net Request (DNR) permission, which allows network request rules to be configured, and host permissions for the target site.
2. Through traffic to the WebView displaying Gemini, they weakened the Content Security Policy (CSP), which restricts resources such as scripts, and redirected requests for legitimate JavaScript to attacker-controlled code.
3. Scripts running within gemini.google.com sent commands to the privilegedchrome://glic interface.
4. In the PoC, local files, PDFs, screen captures, profile information, and the camera and microphone were accessed without additional user clicks. This path does not require sending prompts to the AI.

Flow 2: Edge and Copilot: Race Condition Between Privileged Pages and Mode Switching

1. The extension injected a script into a Microsoft promotional page, gaining access to prompt-sending functions exclusively permitted for that page.
2. Using DNR, the extension weakened page embedding restrictions, and its debugger permission generated click-equivalent events to satisfy user interaction requirements.
3. Immediately after force-sending a prompt in Think mode, the attack switched to Do mode, exploiting a processing race condition.
4. In the PoC, the agent executed information retrieval and actions on authenticated sites while following the attacker's instructions.

Flow 3: Comet and Opera Neon: Sending Commands from Trusted Pages

1. The extension leveraged pages that are trusted by the browser while still allowing script injection.
2. In Comet, DNR removed the HTTP redirect header (Location ) so the target page could load and receive an injected script, invoking communication functions with the built-in agent. In Opera Neon, commands could also be sent from trusted pages.
3. Researchers sent prompts and follow-up prompts, making the agent perform actions such as reading emails and exfiltrating data. This forced transmission is referred to as Prompt-Forcing.

Flow 4: Claude in Chrome: Prompt Transmission Between Extensions

1. The malicious extension modified the claude.ai landing page to set prompts passed to Claude's side panel.
2. By combining click-equivalent events via debugger permissions, prompts could be sent without actual user clicks.
3. Within the permission limits of Claude in Chrome, the agent was instructed to retrieve information or perform actions on authenticated sites.

#

4. Attacker Position and Execution Location

• The prerequisite is that a malicious or compromised extension with the necessary permissions is already installed on the victim's browser.
• The attack intervenes between the AI's web-side processing and the browser-side privileged functions responsible for handling files, tabs, and site interactions. Access paths and privileges vary by product.

#

5. Visibility for Victims and Administrators

Victims

• The PoCs require no additional user interaction once an extension with the necessary permissions is installed. They do not demonstrate compromise without that prerequisite. Some examples also use DNR to hide visible UI elements.

Administrators

• Inference: Clues include the ID, permissions, and update history of installed extensions, as well as AI agent activities involving site interaction or data exfiltration. The availability of DNR rules and conversation logs depends on the environment.

#

6. Conditions for Success and Failure

Conditions for Success

• The target browser and AI features remain vulnerable to the studied flaws.
• A malicious or compromised extension is installed and possesses the necessary permissions for the path, such as target site access and DNR.
• For public PoCs on Edge and Claude to eliminate the need for additional clicks, the extension must also hold debugger permissions.
• Information retrieval and site operations require the target feature to have access to that information or authenticated sites.

Conditions for Failure

• Applying patches for the target vulnerabilities. According to Google and Microsoft CVE records, affected versions are below Chrome 143.0.7499.192 and Edge 150.0.4078.48, respectively. Use the latest supported patched versions in production.
• Inference: Blocking the installation and execution of malicious extensions with required permissions cuts off the path using that extension as an entry point. Separate consideration is needed if an already trusted extension is compromised.

#

7. Impact Upon Success

• The Chrome PoC successfully accessed local files, PDFs, screen contents, browser profile information, camera, and microphone.
• In paths capable of controlling the agent, instructions can be given to read emails, retrieve data from authenticated sites, and exfiltrate data externally. Possible actions depend on the product and granted permissions.
• Researchers noted that unauthorized site actions are also possible. This is a research environment PoC and does not represent confirmed real-world exploitation.

#

8. Observable Logs

Email

• Inference: If the agent reads or sends emails, cross-reference available AI provider conversation logs with email service audit logs.

Proxy, SWG, and DNS

• Inference: Check for communications to the AI provider, extension update servers, and replaced script distribution points. Traffic to legitimate AI services alone cannot identify malicious activity.

Endpoint and EDR

• Inference: Check browser and extension versions, extension IDs and permissions, DNR rules, file/camera/microphone access, and browser processes.

Identity and IdP

• Inference: Check for unusual operations on authenticated sites performed by the agent, token usage, and anomalous sessions or locations.

SaaS and Cloud

• Inference: Review audit logs for email, documents, and corporate SaaS for bulk viewing, sending, or modifying actions performed by the agent.

Network

• Inference: Correlate short-burst communications from the browser to the AI provider and suspicious external destinations to check for abnormal data exfiltration.

#

9. Attack Success Determination

Confirmed via Public Information

Information Theft or Session Compromise Confirmed : Public Info: Researchers demonstrated via PoC that vulnerable configurations allow the retrieval of files and screens, as well as accessing and exfiltrating data from authenticated sites. This does not indicate success in patched environments or real-world damage.

Internal Evaluation Criteria

Information Theft or Session Compromise Confirmed : Criteria: Correlate available conversation logs, SaaS audit records, and evidence of file access or outbound transfers to establish that retrieval and exfiltration followed attacker instructions. Chrome's direct-control path does not require a prompt or conversation record. #

Subsequent Compromise Confirmed : Criteria: Verify state changes such as configuration modifications, email sending, deletions, or transactions individually. The mere presence of prompts does not confirm successful operation.

#

10. Investigation Playbook

Triggers

• Inference: Triggered by unauthorized extensions, unexpected permission additions, or suspicious file access and site operations by AI.

Initial Verification

• Inference: Verify the usage of the five environments, browser and extension versions, installation and update times, and DNR, target site, and debugger permissions.

Endpoints and Servers

• Inference: After evidence collection, examine extension settings and available DNR rules to identify pathways reaching AI-side privileged functions.

Authentication and Cloud

• Inference: Cross-reference accessible conversation logs with operational logs from authenticated sites and SaaS. Do not rely solely on conversation logs when investigating Chrome's direct-control path.

Subsequent Operations

• Inference: Track command transmission, function invocation, information retrieval, external exfiltration, and site state changes separately.

Containment

• Inference: Disable and remove malicious extensions and apply relevant patches. Revoke exposed credentials and sessions.

Classification

• Inference: Distinguish between the presence of an extension, the transmission of commands, and actual data retrieval or operational success. Do not treat research PoCs as actual incident counts.

#

11. Defense and Detection Ideas

Single Events

• Inference: Flag DNR rules added by unapproved extensions and unexpected access to privileged browser or AI agent functions.

Time-Series Correlation

• Inference: Correlate extension installations or updates, script source changes, AI instructions, file and SaaS access, and external exfiltration. For Chrome's direct control path, prompt transmission is not a mandatory detection condition.

Threat Hunting

• Inference: Inventory devices running the five target environments, outdated versions, and extensions with broad permissions, cross-referencing them with accessible AI agent conversation logs.

Log Limitations

• Inference: Because actions execute through the same channels as normal agent operations, process monitoring alone may struggle to determine if instructions are malicious. The availability and retention periods of conversation logs also vary by product.

Priority Countermeasures

• Prioritize updating browsers and AI features, and auditing extensions and their permissions.
• Inference: High-risk operation approvals, privilege separation, and conversation log auditing serve as supplementary measures. Simply adding confirmation screens cannot prevent all pathways, including direct control of privileged functions.

#

12. Facts, Inference, and Hypothesis

Facts

• Forever Security demonstrated a PoC compromising five in-browser AI environments using extensions that were already installed and had the necessary permissions. According to Dark Reading reporting, vendors have acknowledged and resolved the issues.
• In Chrome and Gemini, DNR modified WebView response headers and JavaScript sources to directly control browser-side privileged functions.
• The Chrome PoC accessed local files, web content, PDFs, screens, browser profile information, camera, and microphone without additional user interaction after extension installation.
• Edge combined a promotional page with special prompt-sending capabilities, operation events via debugger permissions, and a race condition switching between Think and Do modes.
• Comet featured weak protection on trusted pages capable of communicating with extensions, allowing command transmission to the built-in agent via DNR-based redirect manipulation and script injection.
• Researchers termed the technique of directly forcing prompts containing commands into the AI as Prompt-Forcing, distinguishing it from indirect prompt injection where instructions are hidden in readable content.

Inference

• Browser extension permissions must be re-evaluated not only for web page modification rights but also for potential impacts on the privileges of embedded AI agents.

Hypothesis

No additional hypotheses. Unverified items are listed in Unknowns and Further Investigation.

#

13. MITRE ATT&CK Mapping

T1176.001 Software Extensions: Browser Extensions (Confidence: High): Attacker-controlled or compromised extensions serve as the entry point. #

T1213 Data from Information Repositories (Confidence: Medium): Access to emails and cloud documents via the agent. #

T1113 Screen Capture (Confidence: High): Screen capture demonstrated in Chrome and Comet PoCs.

#

14. Unknowns and Further Investigation

• Presence of real-world exploitation and examples of malicious or compromised extensions.
• Vulnerable version boundaries outside of Chrome and Edge, patch deployment status across products, and management policy control ranges.
• Scope and retention periods of conversation logs remaining on the AI provider side.

#

15. Impact on SOCs and Organizations

When organizations adopt AI-enabled browsers, extension permissions and AI access rights must be evaluated together. This research demonstrated pathways that directly control browser privileged functions in addition to pathways operating via AI prompts. Audits should combine updates and extension management with the review of accessible conversation logs, file access, and authenticated site operations.

#

16. Summary by Role

SOC : Correlate extension modifications and permissions, available DNR rules and conversation logs, file retrieval, and authenticated site operations. #

Administrators : Update affected browsers to the latest supported patched versions, allow only approved extensions, and limit where agent features are enabled. #

Users : Refrain from installing unapproved extensions and report unexpected operations or data retrievals by AI-enabled browsers.

source & further reading

dev.to — original article WiFi off, model running: what broke (and what shipped) building YOLO26 on MLX A Prompt Injection Turned Into a Shell: Inside Semantic Kernel's Two RCE CVEs My local 7B thinks "kill a Python process" is a violent crime — and my regex beat it