A newly uncovered attack method dubbed “BragJack” exposes a blind spot in AI agent security across major Chromium-based browsers. It enables malicious browser extensions to hijack communication channels used by AI assistants in Chrome, Edge, Opera Neon, Comet, and hosted agents like Claude-in-Chrome. This makes it possible for attackers to issue commands, bypass safety controls, and misuse agent privileges.
How BragJack Works
Security researchers from Forever Security demonstrated BragJack by installing a single malicious extension tailored to each browser’s nuances. The attack leverages content scripts plus the declarativeNetRequest (DNR) API—typically used to modify or filter network traffic—to cross boundaries and send instructions directly to the browser’s AI agent control plane. Rather than embedding dangerous prompts in user-visible content (known as prompt injection), BragJack engages a more insidious approach called “prompt forcing”: manipulating the privilege architecture so commands appear to come from trusted browser components.
This flaw stems from a separation between the “brain” (hosted by a vendor-controlled web origin) and the “body” (residing inside the browser with access to user resources). Because the agent body trusts messages from the vendor origin, an extension that can interfere with or impersonate that origin—e.g. by modifying resources loaded via WebView or intercepting network requests—can effectively take control.
Real-World Risks & Browser Responses
In Chrome’s Gemini, the extension replaced a legitimate JavaScript file loaded in WebView and gained elevated powers, including reading local files, taking screenshots, and accessing the camera and microphone—despite the model’s safety layers. Google responded by patching Chrome 143.0.7499.192/193 to address the issue under CVE-2026-0628 (severity 8.8).
Edge was affected via a race condition in its Copilot prompts flow; attackers exploited the shift between “Think” and “Do” modes to push prompts at a sensitive moment. That vulnerability was tracked as CVE-2026-55945.
Other browsers were similarly exposed. In Comet, a testing domain trusted by Perplexity origins was unprotected and allowed an extension to inject content scripts and issue commands. Opera Neon’s implementation allowed code running on opera.com to send arbitrary instructions. Claude use was compromised by abusing rights from another extension, showing that even non-browser agents can be hijacked via exposed message-passing pathways.
What Users and Security Teams Should Do
This attack requires the extension to be installed—there’s no “zero-click” remote takeover, but once present the damage can be severe. So far, no BragJack exploits have been spotted in the wild; vendors have paid out about $20,000 in bug bounties in combined recoveries.
Users are advised to immediately update Chrome and Edge, ensure AI-enabled features are up to date, and remove unnecessary or poorly vetted extensions. For organizations, the recommendations include enforcing strict extension allowlists, tightening host and DNR permissions, controlling debugger access, and monitoring when browsers suddenly access local files, mic/camera, or authenticated content.
From a platform design perspective, BragJack reveals that agent architectures need robust origin validation, least-privilege models, segregated command channels, explicit user confirmations for sensitive actions, and transparent audit logs. Without those, attackers can manipulate trusted interfaces in ways that safety filters can’t intercept.
Analytical Takeaway: BragJack shines a spotlight on how increasingly complex AI assistant systems introduce new vectors for exploitation—particularly when trust boundaries between web origins and browser privileges are blurred. Moving forward, device vendors and AI developers need to think not just about what models say, but how instruction channels are architected. Security teams shouldn’t wait for one of these vulnerabilities to be weaponized in the wild—it’s time to audit AI agent pipelines, limit what extensions can do, and bake in features that assure both accountability and control.
