BragJack shows one malicious extension can hijack AI browser agents

Attack technique exposes how compromised extensions can drive built-in AI agents with broad browser privileges.

Security researcher Gal Weizman disclosed “BragJack,” a proof‑of‑concept attack showing that a single malicious Chromium extension can hijack built‑in AI browser agents in Chrome’s Gemini Live, Perplexity Comet, Microsoft Edge, Opera Neon, and Anthropic’s Claude in Chrome. The attack abuses Chromium’s declarativeNetRequest API to tamper with traffic and headers trusted by privileged AI components, enabling arbitrary code execution in contexts that can read local files, capture screenshots, and in some cases control agentic browsing actions. Google and Microsoft assigned CVE‑2026‑0628 and CVE‑2026‑55945 respectively, and together with the other affected vendors paid Weizman over $20,000 in bug bounties. Weizman labels the underlying technique “Prompt Forcing,” where a compromised extension can feed full prompts and follow‑up instructions directly to the AI agent, which then performs the actions with its existing browser‑level privileges. For developers and browser vendors, the research highlights that extension‑level compromises now reach far beyond web content, requiring stricter origin checks, domain trust models, and verification that AI‑driven actions are genuinely user‑initiated.