BragJack Exploits AI Browser Agents via Malicious Extensions

Post Views: 8

A security researcher has uncovered a novel method enabling the compromise of AI assistants integrated into major web browsers via a single malicious extension. The technique, named BragJack, was demonstrated against five Chromium-based browsers and their AI-driven features, including Google Chrome’s Gemini Live, Perplexity Comet, Microsoft Edge, Opera Neon, and Anthropic’s Claude within Chrome.

BragJack Overview

The findings, disclosed by Gal Weizman of Forever Security, led to over $20,000 in bug bounty rewards from the affected vendors, with individual payouts ranging from $600 to $7,000. Two Common Vulnerabilities and Exposures (CVEs) were assigned to address the vulnerabilities.

Attack Mechanism

The attack hinges on the presence of a malicious browser extension already installed in the target system. Once activated, the extension can manipulate the AI assistant without user interaction, leveraging its existing permissions to access sensitive data or perform actions on behalf of the user.

Vulnerability Details

Google and Microsoft have since addressed the specific flaws they were responsible for. The research highlights a critical vulnerability in how AI assistants are integrated into browsers, relying on a “brain” for decision-making and a “body” to execute actions such as accessing tabs, reading content, capturing screenshots, or interacting with websites.

Technical Exploitation

Weizman’s analysis revealed that browser extensions can exploit trusted components of these systems by intercepting network traffic and altering request flows. The same malicious extension was used across all five targets, utilizing Chromium’s declarativeNetRequest (DNR) functionality to modify network requests.

Google Chrome’s Gemini Live

In the case of Google Chrome’s Gemini Live, the extension bypassed restrictions on direct access to the chrome://glic component by intercepting requests from the embedded Gemini web app. By adjusting security headers and redirecting a JavaScript resource, the attacker executed code within the Gemini context, enabling communication with Chrome’s privileged AI component.

Perplexity Comet and Opera Neon

The attacks on agentic browsers like Perplexity Comet and Opera Neon demonstrated more extensive capabilities, as these systems can perform actions on websites rather than merely reading data. For Comet, Weizman exploited the browser’s trust in specific Perplexity domains, including a testing environment with weaker protections.

CVEs and Rewards

The flaw was assigned CVE-2026-0628 and earned a $7,000 reward. Microsoft Edge presented a unique challenge due to its “Think” and “Do” modes, which separated decision-making from execution. Weizman identified a race condition that temporarily disabled restrictions during a prompt, allowing the agent to execute actions before re-enabling safeguards. This vulnerability was assigned CVE-2026-55945.

Additional Vulnerabilities

Similar flaws were demonstrated against Opera Neon and Claude in Chrome, with the latter’s architecture as a browser extension introducing additional risks. Weizman’s research also revisited a previously reported issue in Claude for Chrome, where the extension’s AI workflows relied on synthetic user interactions without verifying their authenticity.

Prompt Forcing Technique

The technique, termed “Prompt Forcing” by Weizman, differs from traditional prompt injection attacks. Instead of altering content the AI is already processing, it directly provides the agent with a complete prompt and instructions, leveraging its existing privileges to execute browser-level actions.

Security Implications

This approach circumvents conventional endpoint defenses, as the malicious activity appears to originate from legitimate software. The BragJack findings underscore a growing risk as browsers and endpoint applications incorporate more advanced AI agents.

Recommendations

Recommendations for mitigating such threats include maintaining up-to-date browsers, removing unrecognized or unused extensions, and exercising caution with broad permission requests. Weizman’s detailed technical analysis covers all five attack scenarios, providing insights into the vulnerabilities and their exploitation mechanisms.

“The research emphasizes the need for robust security measures as AI integration in web platforms continues to expand.”

Conclusion

The BragJack findings highlight the critical need for vigilance in securing AI-driven browser features. As these systems become more integrated into daily workflows, the potential for exploitation through malicious extensions grows, necessitating proactive security strategies.