A recent discovery named the ‘BragJack’ exploit has uncovered a critical vulnerability within AI-powered browser extensions across major platforms like Chrome, Edge, Opera Neon, Comet, and Claude in Chrome. This attack technique allows malicious extensions to commandeer secure communication channels of AI assistants.
Understanding the BragJack Exploit
Unlike traditional methods that bypass security measures by embedding hidden instructions in web content, BragJack directly issues commands to essential browser components. This bypasses the security protocols of AI models, effectively transforming AI assistants into tools for unauthorized actions.
Gal Weizman, a researcher from Forever Security, demonstrated the attack’s feasibility across five Chromium-based browsers utilizing an extension with specific rules per browser. The extension leverages content scripts and the declarativeNetRequest API (DNR), which are typically employed by ad blockers to modify network traffic, allowing untrusted code to infiltrate a privileged AI control environment.
Technical Insights and Vulnerabilities
Research from Forever Security highlights that the vulnerability stems from the architecture linking AI ‘brains’ on vendor-controlled sites to a powerful ‘body’ within the browser. This setup allows the browser body to inspect and manipulate web pages, while a trusted origin delivers instructions.
By exploiting this trusted origin or an authorized page, the malicious extension can issue commands as if they originate from the browser vendor. This form of attack, termed ‘prompt forcing,’ differs from prompt injection by allowing complete control over the prompt and its execution timing, bypassing model-level safety filters.
Google’s Chrome faced issues with content-script injections but was vulnerable to DNR rule interceptions. This allowed attackers to execute code in a trusted context, gaining access to local files and user data. Google addressed this with CVE-2026-0628, a high-severity vulnerability, releasing fixes in Chrome versions 143.0.7499.192/.193.
Impacts and Security Measures
The BragJack exploit had varying impacts across different browsers. Comet exhibited the broadest impact due to its reliance on multiple Perplexity origins, including unsecured domains. This allowed unauthorized access to browsing history, screenshots, and local files.
On the Opera Neon platform, code executed on opera.com could send unapproved prompts to the AI agent. Microsoft Edge required a more complex exploit chain, manipulating prompt intake through timing to execute unintended commands.
Claude in Chrome was targeted through a marketing page, exploiting permissions to manipulate the AI assistant, showcasing the risk of cross-extension vulnerabilities. Although no real-world attacks have been reported, vendors awarded approximately $20,000 in bounties for these discoveries.
Organizations are advised to promptly update Chrome and Edge, maintain updated AI-enabled browsers and assistants, and restrict unnecessary extensions. Enterprises should enforce strict extension policies, limit permissions, and monitor unusual access patterns.
Future Security Considerations
The lessons from BragJack underscore the need for rigorous origin validation, minimized privileges, isolated command channels, and explicit confirmations for sensitive operations. Security teams should implement audit logs to monitor AI-agent activities, ensuring trusted software remains within expected operation parameters.
