BragJack Attack Hijacks Browser AI Assistants via Malicious Extensions

Researchers have identified a novel attack vector named BragJack that enables malicious browser extensions to hijack agentic AI assistants built directly into web browsers. The proof-of-concept attack successfully compromised five major browser environments, including Google Chrome with Gemini and Microsoft Edge with Copilot.

Gal Weizman, an agentic software and browser vulnerability researcher at Forever Security, discovered the flaw. The research has already resulted in more than $20,000 in bug bounties from the affected technology companies.

Architectural Flaws Enable Extension Hijacking

Unlike most recent AI-based threats that rely on prompt injection—where an attacker hides instructions within data that an AI is expected to read—BragJack exploits a fundamental architectural flaw. The vulnerability exists in the way agentic browsers manage the communication channel between untrusted browser extensions and highly privileged AI agents.

By hijacking this channel, an attacker can bypass traditional AI guardrails. Rather than attempting to trick the AI with clever phrasing, the attacker can force prompts into the browser’s built-in agent, compelling it to execute unauthorised actions.

The vulnerability affected several popular agentic browser environments, including:

• Google Chrome with Gemini
• Microsoft Edge with Copilot
• Opera Neon
• Perplexity Comet
• Claude in Chrome

Technical Manifestation and CVEs

While the underlying architectural problem was consistent across all five browsers, the specific method of exploitation varied. In Google Chrome, researchers found that although Chrome blocked extensions from injecting scripts directly into the Gemini page, it failed to prevent extensions from modifying the network requests used to load the service. This allowed attackers to substitute JavaScript, granting them control over the browser-side body of the AI. This control enabled the taking of screenshots, access to local files, and the activation of the user’s camera and microphone without interaction.

In Microsoft Edge, the attack required chaining two distinct weaknesses. Researchers identified a Microsoft marketing page with special privileges to send prompts to the browser agent. They then bypassed network-level defences by exploiting a race condition between the browser’s “Think” and “Do” modes, allowing the agent to accept and execute malicious instructions.

Both Google and Microsoft have addressed these vulnerabilities and issued formal CVEs. The flaws are tracked as CVE-2026-0628 for Chrome and CVE-2026-55945 for Edge.

Defensive Strategies for Organisations

Because the attack relies on the presence of at least one malicious or compromised extension, the risk extends to hundreds of millions of users. The compromised agents were capable of accessing sensitive email correspondence, leaking data, and performing destructive operations on any website where the user was authenticated.

To defend against BragJack and similar hijacking attempts, security experts recommend the following actions:

• Immediate Updates: Ensure all Chromium-based browsers within an organisation are updated to the latest version to patch known vulnerabilities.
• Extension Governance: Remove any browser extensions that have not been formally vetted or are not widely recognised as safe.
• SOC Monitoring: Security Operations Centres (SOCs) should monitor transcripts of interactions between browser agents and their AI provider servers to identify suspicious behaviour.
• Next-Generation EDR: Organisations should consider adopting endpoint detection and response (EDR) tools capable of intercepting operations made by agentic components and using AI to distinguish between legitimate and malicious tasks.