Security Alert | BragJack: One Browser Extension Hijacks the Built-In AI Agents in Chrome, Comet, Edge, Opera Neon, and Claude in Chrome

🌏 中文版

Incident Overview

On September 16, 2026, security researcher Gal Weizman of Forever Security published research codenamed BragJack, demonstrating that a single technique — carried out through a browser extension requiring only two extremely common permissions — could hijack the built-in AI agents of five products: Gemini Live in Google Chrome, Perplexity's AI browser Comet, Microsoft Edge, Opera's Opera Neon, and the Claude in Chrome extension. Every attack required zero clicks from the victim; the only precondition was that the malicious extension was already installed. The research has earned roughly $20,000 in combined bug bounties from Google, Microsoft, Perplexity, Opera, and Anthropic. The Chrome and Edge findings each received a CVE and have been patched; the Comet, Opera Neon, and Claude in Chrome findings have no CVE and rest on Forever Security's own technical account, though each vendor confirmed the finding and paid a reward. No evidence currently suggests any of the five methods has been used in a real-world attack.

Key Facts

Attack Surface Analysis

All five products share nearly the same architecture: a "body" inside the browser that can take screenshots, read files, and control the camera and microphone, and a "brain" — the actual AI model — running on the vendor's servers. The body only accepts instructions from a single trusted origin, such as gemini.google.com, opera.com, or copilot.microsoft.com. Weizman found that while browser extensions are explicitly barred from controlling the browser directly, nearly every extension still holds two permissions that go almost entirely unguarded: content scripts (which any ad blocker needs) and declarativeNetRequest (which lets an extension rewrite the browser's outbound network requests). Combining the two lets an extension impersonate the trusted origin and send instructions straight to the brain, which then translates them into actions the body carries out on the victim's machine — breaking the foundational assumption that an extension can modify a page but never control the browser itself.

Each product failed in a different way. Chrome blocked extensions from injecting scripts into the Gemini page but forgot to block network-request rewriting, letting the attacker swap in their own JavaScript. Opera Neon didn't restrict extensions on opera.com at all. Microsoft Edge created a special permission that let only its marketing page send prompts to the brain, and split the agent into mutually exclusive "Think" and "Do" modes as a safeguard — but a race condition, triggered by feeding it a prompt and switching it to "Do" mode at the exact right moment, defeated that safeguard. Claude in Chrome fell to the same underprotected marketing-page permission pattern as Edge. Comet had the tightest defenses of the five — it blocked extensions from running on perplexity.ai entirely — but a leftover, unlocked test domain, testing.perplexity.com, let the attacker strip a redirect header and load that domain to send commands directly to the browser-wide agent. Forever Security calls Comet the worst case: it let the attacker read arbitrary local files, see the user's full browsing history, and act as the user.

The researchers stress this is not prompt injection — nothing was appended to an existing instruction. Instead, the attacker wrote and sent the entire instruction, then kept issuing follow-ups, a technique the researchers call "Prompt-Forcing." The distinction matters: traditional EDR tools detect malicious code, but nothing here is malicious code. A trusted, legitimate component (the extension) does exactly what it's permitted to do (rewrite pages and requests), which drives another trusted, legitimate component (the AI agent) to perform an ordinary but abused task, like "summarize my email and send it to me." Mapped to the OWASP LLM Top 10, this is closest to LLM06 Excessive Agency — once an agent's instruction channel is hijacked, it acts on the user's behalf without limit — combined with the classic security concept of a confused deputy, where the browser's sole criterion for trusting an instruction (which origin it came from) turns out to be spoofable.

Defense

Forever Security's own conclusion is blunt: once software starts embedding AI, its attack surface becomes hard to predict, because traditional security tooling is built to catch malicious code — and this class of attack has none.

Immediate actions

• Inventory every endpoint running a browser's built-in AI agent (Chrome's Gemini, Edge Copilot, Comet, Opera Neon, Claude in Chrome), and confirm Chrome is updated to 143.0.7499.192+ and Edge to 150.0.4078.48+ to pick up the two patched CVEs.
• Audit installed browser extensions for any that request both content-script access and declarativeNetRequest — the minimum permission set BragJack-style attacks require.
• For Comet, Opera Neon, and Claude in Chrome, where no patch timeline has been published, assume the risk is live and restrict these tools' access to sensitive data environments (finance, HR systems) in the meantime.

Long-term architecture

• Govern browser extensions as high-privilege third-party software rather than default-trusted utilities; consider an extension allowlist restricted to security-reviewed extensions.
• Traditional EDR cannot detect "a legitimate component executing a legitimate but abused instruction." Watchlist B7 vendors such as Lakera and Invariant Labs build runtime guardrails in a similar direction — worth evaluating for coverage of browser-agent scenarios specifically.
• Treat any AI agent capable of acting on a user's behalf (especially fully agentic browsers like Comet) as a privileged identity requiring least-privilege scoping and behavioral auditing, rather than trusting a single origin — a criterion this research shows can be bypassed.

Impact

As of September 16, 2026, neither CVE (Chrome, Edge) appears on the U.S. CISA Known Exploited Vulnerabilities (KEV) catalog, and neither Forever Security nor the affected vendors report evidence that any of the five methods has been used in a real attack — this is a responsible disclosure, not an ongoing incident. But because the trigger condition is simply "the victim already has the malicious extension installed," the bar is far lower than most browser-level vulnerabilities; anyone relying on the extension ecosystem (ad blockers, coupon extensions, etc.) while also using one of these five AI agent products falls within the potential exposure. The Comet, Opera Neon, and Claude in Chrome findings currently rest solely on Forever Security's technical account — vendors confirmed and paid for them but haven't published exact patched versions or timelines, so it's worth watching for further announcements from all three.

For teams evaluating or already deploying browser-native AI agents, the takeaway isn't just "install the right extensions." It's that once any software component is granted the ability to operate an entire machine, deciding whether to trust an instruction based solely on "which origin it came from" will always be bypassable.

Today's Takeaway

Past coverage of browser extension risk mostly focused on extensions that ship malicious code and steal data directly. BragJack points to a different path: the extension does nothing malicious at all. It simply uses two ordinary permissions — rewriting pages, rewriting network requests — to hijack the single-origin trust channel that was supposed to connect the browser to its built-in AI agent, turning a completely legitimate agent into the attacker's proxy. That's also why the researchers went out of their way to distinguish this from prompt injection: the defense isn't "filter out malicious prompts," it's "verify this instruction actually came from where it claims to, and ask whether what the agent is doing right now makes sense in context."

References

• Forever Security — BragJack: How We Hijacked 5 Of The World's Most Popular Browsers Using Their Built-In AI Assistants (2026-09-16)
• The Hacker News — One Extension Could Hijack AI Assistants Across Chrome, Comet, Edge, Opera Neon and Claude (2026-09-16)
• Dark Reading — BragJack Attack Can Turn a Browser's Agentic AI Against It
• NVD — CVE-2026-0628 (Chrome / GlicJack, CVSS 8.8)
• NVD — CVE-2026-55945 (Microsoft Edge, CVSS 4.2)
• OffSeq Threat Radar — BragJack: $20K in bounty rewards from Anthropic, Perplexity, Google, Microsoft and Opera