One Malicious Extension Was Enough to Hijack Five Browsers’ Built-In AI Agents

A single browser extension, installed once, was enough to hijack the built-in AI assistants in five of the most popular Chromium-based browsers on the market. Security researcher Gal Weizman of Forever Security disclosed the technique, called BragJack, on September 16. It worked against Google Chrome’s Gemini Live, Microsoft Edge, Opera Neon, Perplexity Comet, and Anthropic’s Claude in Chrome, and it did all of that without bypassing a single AI guardrail or writing a line of conventional prompt injection.

The research earned Weizman more than $20,000 in bug bounties across the five vendors and produced two CVEs. Google and Microsoft have since fixed the flaws they were assigned. What makes BragJack notable isn’t the payout or even the number of browsers affected. It’s that every one of the five bugs traced back to the same structural mistake: browsers now wire a privileged, action-taking AI agent into the same extension ecosystem that has spent two decades being a favorite target for attackers, and none of the five vendors had fully accounted for what happens when the two meet.

One Extension, Two Privileges It Was Never Supposed to Combine

Weizman frames the design flaw as a browser’s AI assistant having a “brain” and a “body.” The brain is the language model itself, often running on a vendor’s own servers, that decides what should happen next. The body is a privileged component built into the browser that carries those decisions out: reading tabs, taking screenshots, touching the camera or microphone, or acting on websites on the user’s behalf. Browser extensions are supposed to be sealed off from that body. Their job is limited to modifying the web pages a user visits.

Weizman found that limit had a gap. Nearly every extension has access to two capabilities by default that almost nobody blocks: content scripts, which inject JavaScript into a page, and Chromium’s declarativeNetRequest (DNR) API, which lets an extension rewrite network requests, including response headers and redirected resources, as they pass between the browser and the internet. Content scripts alone weren’t enough. Chrome, like the other vendors, blocked extensions from running scripts directly on privileged AI surfaces such as Gemini’s own web app. But none of the five browsers blocked DNR from touching those same privileged requests. By using DNR to weaken a security header and redirect a JavaScript resource the AI component was about to load, Weizman could get his own code to execute inside a context the browser trusted implicitly, without ever touching the code-injection restriction that was supposed to stop him.

From there, according to BleepingComputer, the access ranged from reading local files and browsing history to taking screenshots and, in Chrome’s case, potentially reaching the camera and microphone. The attack requires the malicious extension to already be installed. Once it is, Weizman’s proof of concept runs without any further clicks from the victim.

Five Browsers, One Bug Class, Very Different Blast Radius

Chrome’s Gemini Live was where Weizman started, and unlike the other four, his proof of concept there didn’t demonstrate a full agent hijack, only the broadest raw data exposure of the five: local files, browser-profile data, screenshots, and the possibility of camera and microphone access, all through a WebView-related flaw Google fixed under CVE-2026-0628, a high-severity issue (CVSS 8.8) that NVD describes as “insufficient policy enforcement in WebView tag” allowing an attacker who convinced a user to install a malicious extension to inject scripts into a privileged page. Google paid $7,000 for it and shipped the fix in Chrome 143.0.7499.192.

The four other targets could go further, because their agents don’t just read a page, they act on it. Microsoft Edge had split its agent into separate “Think” and “Do” modes specifically to stop it from taking arbitrary instructions and actions in the same breath. Weizman found a race condition that briefly disabled that separation while a forced prompt was in flight, then let the action capability re-enable before the agent checked its own state. Microsoft assigned it CVE-2026-55945 and paid $5,000. Opera Neon’s built-in agent and Anthropic’s Claude in Chrome extension were hijacked through similar variations of the same DNR technique, earning $900 and $600 respectively; Anthropic classified its issue as medium severity. Unlike Chrome and Edge, none of Perplexity, Opera, or Anthropic received a public CVE for their findings, and the disclosure doesn’t say whether any of the three has shipped a fix yet, only that all three paid out bounties for the reports.

Perplexity’s Comet browser was, in Weizman’s own description, “by far the worst exploit” in the research. Comet’s entire browsing experience is built around its agent, which Perplexity had given the same broad permissions as the browser itself. Weizman found the agent trusted several Perplexity-owned domains, including a testing domain that hadn’t received the same hardening as the main site. Removing a redirect with DNR let him load that domain and inject a script that could talk directly to the agent, gaining access to browsing history, screenshots, local files, and the ability to issue it new instructions outright. As a demonstration, he forced the agent to visit Perplexity, summarize the victim’s email inbox, and send the results to an address he controlled. It was also tied with the Chrome finding for the highest payout in the research, worth $7,000.

Not Prompt Injection, Something the Researcher Calls Worse

What separates BragJack from the wave of prompt-injection research that’s preceded it is that Weizman never had to trick a model into misreading anything. In a conventional prompt injection, an attacker hides malicious instructions inside content the AI is expected to process and hopes it follows them. BragJack skips that step entirely. “They didn’t need to cleverly hide instructions in data the agent interacts with, hoping it would take the bait; they could just send one prompt after the other until the agent got convinced to do anything,” Weizman told Dark Reading in an email interview. He calls the technique Prompt Forcing: rather than smuggling instructions into data, the attacker seizes the channel the agent already trusts and hands it a complete prompt directly.

That distinction matters for defenders more than it might first appear. A prompt-injection defense that scans incoming content for suspicious instructions has nothing to catch here, because the final action isn’t carried out by malicious code at all. It’s carried out by the browser’s own legitimate AI component, doing exactly what it was told by a channel it had no reason to distrust.

An Old Attack Surface Gets a New Reason to Matter

BragJack is Weizman’s second round of research along this line. He disclosed a narrower, Chrome-only version, which he called GlicJack, earlier in 2026. BragJack shows the same underlying assumption, that an extension’s network-editing permissions can’t reach a browser’s privileged AI surface, failed identically across five independently built products from five different companies. None of that changes the fact that browser extensions remain one of the least scrutinized pieces of software most people run, and BleepingComputer’s practical advice for users reflects that: keep browsers updated, remove extensions that aren’t in active use, and treat any extension asking for broad “read and change all your data on all websites” permissions with real suspicion, especially now that the payoff for an attacker who gets one installed has grown considerably.