Security researcher Gal Weizman of Forever Security revealed a new attack technique called BragJack, which allows a malicious browser extension to take control of artificial intelligence assistants integrated into browsers and services built on Chromium. The tests covered Google Chrome with Gemini Live, Perplexity Comet, Microsoft Edge, Opera Neon, and Claude in Chrome.
The attack begins only after the malicious extension is installed on the victim’s browser, but it demonstrated that exploitation could be carried out without additional user interaction. According to the research, the extension can exploit the AI agent’s permissions to access sensitive information or perform web actions on behalf of the browser owner.
Exploiting Trusted Components
The usual design of these systems separates the artificial intelligence model that interprets instructions from a privileged browser component that executes them, such as reading tabs and content, capturing screenshots, or interacting with websites. Weizman found that the extension could manipulate traffic and pages trusted by the privileged component.
The five tests used Chromium’s declarativeNetRequest function, which allows extensions to modify how network requests are handled, including changing response headers and redirecting resources. In Chrome, this mechanism was used to intercept requests from the embedded Gemini application, weaken some security headers, and redirect a JavaScript resource to execute code within the Gemini context, then communicate with the privileged AI component.
The researcher said the result could allow the reading of local files, access to web content, the capture of screenshots, and potentially access to the camera and microphone. Google assigned the case CVE-2026-0628 and paid a reward of $7,000. The article also said that Google and Microsoft fixed the vulnerabilities reported to them.
From Reading Data to Directing the Agent
In Perplexity Comet and Opera Neon, the risks were broader because the agents can perform actions on websites rather than merely read content. The researcher found that the integrated Comet extension trusted several domains belonging to Perplexity, including a test domain that was not protected, such as perplexity.ai. Using DNR, he removed a redirect to that domain and loaded a page that enabled the injection of a content script and communication with the agent.
The test demonstrated the ability to access browsing history, screenshots, and local files, in addition to sending instructions to the agent. In the demonstration, the agent was forced to visit Perplexity, summarize the victim’s email messages, and then send the results to another address.
In Edge, the researcher exploited a race condition in the separation Microsoft introduced between Think and Do modes. It was possible to temporarily disable the restriction while a prompt was being passed, then re-enable execution capability before the agent checked its state. Microsoft assigned the case CVE-2026-55945. The research mentioned similar techniques against Opera Neon and Claude in Chrome, the latter being a browser extension rather than a standalone browser.
Why Does This News Matter?
Weizman calls the technique Prompt Forcing to distinguish it from traditional prompt injection; the attacker does not merely insert instructions into content read by the model, but passes the agent a complete prompt and follow-up instructions, causing the agent to turn those instructions into legitimate actions using its permissions. In practice, the compromised extension becomes a bridge to a component capable of reading data and acting on websites, while the execution may not appear to be traditional malicious code.
The research earned more than $20,000 in bug bounty rewards from the five vendors, ranging from $600 to $7,000, and resulted in a CVE assignment. For users, the article recommends updating browsers, removing unknown or unused extensions, and exercising caution with permissions such as “read and change all your data on all websites.” The source does not establish that all of these paths remain available in current versions after the fixes, so each product’s status remains tied to its updates and the actions of its manufacturer.