BragJack Exploit Exposes Systemic Flaws in AI Browsers

By summarizing pages, responding to inquiries, and taking action on your behalf, your browser's integrated AI assistant is meant to be a useful friend. However, recent studies show that a single malicious extension can take control of this same assistant, transforming it into a tool for illegal activities, data theft, and surveillance. The BragJack attack is a wake-up call for anyone who relies on artificial intelligence to act on their behalf because it reveals a systemic architectural flaw that affects five major browsers.

What Is BragJack?

On September 16, 2026, security researcher Gal Weizman of Forever Security revealed BragJack, which showed how a single, seemingly innocuous browser extension could take control of the built-in AI agents of five different agentic browsers: Opera Neon, Microsoft Edge Copilot Actions, Perplexity Comet, Google Chrome's Gemini Live, and Anthropic's Claude in Chrome.

In addition to generating two CVEs (CVE-2026-0628 for Chrome's Gemini Live (CVSS 8.8) and CVE-2026-55945 for a race condition in Microsoft Edge), the attack brought Weizman more than $20,000 in bug bounties. The fixes have been shipped by both vendors.

The "Prompt Forcing" Technique

In contrast to conventional prompt injection, which uses well-crafted text to fool an AI model, BragJack employs a method Weizman refers to as "Prompt Forcing." Without having to get around any model-level safeguards, the malicious extension gives the AI agent an attacker-authored instruction directly by abusing standard, already-granted permissions.

The method is based on the declarativeNetRequest (DNR) API in Chromium, which extensions use to change network responses and reroute requests. The extension can communicate directly with browser components that extensions typically cannot access by altering resources that the AI assistant trusts. This allows the extension to insert code into the assistant's privileged context.

What a Successful Attack Can Do

A successful BragJack chain may require the agent to: Depending on the browser

• Examine local files and directories

• Exfiltrate past browsing activity

• Turn on the microphone or camera.

• Take screenshots

• Check your email

• Perform authenticated actions on websites where you are logged in.

• All without a visible confirmation popup or a traditional prompt injection payload.

Weizman showed how to make the agent visit Perplexity, compile the victim's emails, and transfer the findings to a different address in Perplexity Comet. The exploit may gain access to local files, web content, and maybe the camera and microphone in Chrome.

The Root Cause: An Architectural Gap

BragJack's vulnerability isn't a single software error, according to CSA's investigation. Each browser manufacturer created a privileged communication channel between its AI agent and trusted first-party pages, but they neglected to completely isolate that channel from the distinct, well-documented permissions that Chromium currently gives to any installed extensions.

In an effort to lessen this, Microsoft Edge divided its agent into distinct "Think" and "Do" modes, separating browser operations from instruction processing. Weizman discovered a race condition that momentarily disables the restriction, enabling an attacker to provide commands while still having the capacity to initiate activities.

How to Protect Yourself

Although installing a malicious extension is a prerequisite for these attacks, the repercussions are dire. Users and administrators ought to:

• Remove superfluous extensions and enforce extension allowlists.

• When feasible, limit wide host and DNR permissions.

• Keep an eye on browser-driven file, email, authenticated application, camera, and microphone access.

• Update your browser and ask extensions for permission to read and modify data on all websites.

BragJack shows that the distinction between "attacker-controlled tool" and "friendly AI assistant" is hazier than previously thought.

At Bayon Technologies Group, we assist businesses in managing the novel risks brought forth by AI-powered solutions. We guarantee that your digital environment is shielded from new threats with everything from browser security evaluations to AI agent governance frameworks. To find out how we can help you protect your AI-powered workflows, get in touch with us right now.