Safa Marwah
A significant new security vulnerability has emerged, demonstrating how malevolent browser extensions can commandeer the built-in artificial intelligence assistants within leading web browsers, potentially compromising sensitive user data and executing unauthorized actions. This innovative attack, designated "BragJack," exposes critical weaknesses in the architectural integration of AI capabilities within the browser environment, highlighting a burgeoning threat landscape.
Disclosed by security researcher Gal Weizman of Forever Security, the BragJack technique illustrates a sophisticated method for gaining unauthorized control over embedded AI functionalities. The proof-of-concept successfully targeted five prominent Chromium-based browsers or their integrated AI components: Google Chrome’s Gemini Live, Perplexity Comet, Microsoft Edge, Opera Neon, and the Anthropic Claude extension for Chrome. This groundbreaking research not only earned over $20,000 in bug bounties from the affected vendors but also resulted in the assignment of two Common Vulnerabilities and Exposures (CVEs), underscoring the severity and novelty of the findings. The prerequisite for this exploit is the prior installation of a malicious extension on the victim’s browser, after which the researcher demonstrated that the abuse can proceed without any further user interaction, allowing the rogue extension to dictate the AI agent’s behavior and exploit its inherent privileges for data exfiltration or performing actions on the user’s behalf. Both Google and Microsoft have since implemented patches to address the identified vulnerabilities within their respective products.
The Evolving Landscape of Browser AI Integration
The proliferation of AI directly integrated into web browsers marks a paradigm shift in how users interact with the internet. These AI assistants are designed to enhance productivity, streamline information retrieval, and even automate complex web-based tasks. However, this deep integration also introduces new attack surfaces and necessitates a re-evaluation of established security models. Traditionally, browser extensions have operated within a defined security perimeter, with permissions governing their access to web content, browsing history, and certain browser APIs. The introduction of AI agents, endowed with broader capabilities and direct access to browser functionalities, fundamentally alters this security calculus.
Weizman’s analysis adeptly frames these integrated AI systems as possessing a "brain" and a "body." The "brain" represents the underlying AI model, responsible for processing user prompts, understanding context, and formulating a response or action plan. The "body," conversely, comprises the privileged browser components that execute these plans. These components are granted elevated permissions to perform actions such as accessing open tabs, reading page content, capturing screenshots, interacting with web elements, and even accessing hardware like cameras and microphones. The core vulnerability identified by BragJack lies in the ability of a malicious browser extension to manipulate the web traffic and content that these otherwise trusted, privileged AI "body" components rely upon.
Leveraging DeclarativeNetRequest for Covert Control
A critical enabler for the BragJack attacks across all five targeted systems was the Chromium browser’s declarativeNetRequest (DNR) functionality. DNR is a powerful API that allows extensions to declaratively specify rules for intercepting and modifying network requests, including altering response headers, blocking requests, or redirecting resources. Unlike programmatic web request modification, DNR rules are processed by the browser’s native code, making them efficient and difficult for web applications to detect or circumvent.
In the specific instance of the Google Chrome attack targeting Gemini Live, Weizman uncovered that while direct script injection into the highly privileged chrome://glic component (which serves as Gemini’s interface) was blocked, and injecting scripts directly into Google’s Gemini website was also prevented, DNR rules provided an indirect vector. By strategically deploying DNR rules, the malicious extension could intercept requests originating from the embedded Gemini web application. This interception allowed for two critical manipulations: first, weakening crucial security headers (such as Content Security Policy, CSP) for specific resources, and second, redirecting a legitimate JavaScript resource to a malicious one controlled by the attacker. This redirection effectively executed attacker-controlled code within the privileged Gemini context. The outcome was direct communication with Chrome’s core AI component, bypassing Gemini’s intended request flow. This level of access, as demonstrated, could facilitate the reading of local files, unrestricted access to web content, screen capturing, and potentially, control over the device’s camera and microphone. Google acknowledged this significant finding with CVE-2026-0628 and a $7,000 bounty.
Expanding the Threat: Agentic Browsers and Data Exfiltration
The implications of BragJack deepen when applied to "agentic" browsers like Perplexity Comet and Opera Neon. These browsers are designed with AI agents capable not just of reading and summarizing web content but also of actively performing actions on websites, such as navigating, filling forms, and interacting with web applications. The malicious extension’s ability to control these agentic capabilities significantly escalates the potential for harm.
For Perplexity Comet, Weizman discovered that the browser’s integrated AI agent extension implicitly trusted several Perplexity-owned domains, including a testing domain that lacked the robust security protections of the primary perplexity.ai site. By leveraging DNR to remove a redirect to this less-secure testing domain, the attacker could force the browser to load it and then inject a content script. This script, operating within a trusted context, could then directly communicate with the built-in AI agent. The resulting compromise granted access to a wide array of sensitive information, including the user’s browsing history, screenshots, local files, and critically, the ability to issue arbitrary instructions to the agent. A chilling demonstration involved forcing the agent to visit a user’s email service, summarize their emails, and then transmit the summaries to an attacker-controlled address, showcasing a complete chain of data exfiltration and unauthorized action.
Microsoft Edge presented a unique challenge due to its architectural design, which separates AI agent functions into distinct "Think" and "Do" modes. This separation was intended to prevent the agent from simultaneously receiving arbitrary instructions and executing corresponding actions. However, Weizman identified a race condition vulnerability (CVE-2026-55945) that temporarily disables this restriction. By carefully timing a forced prompt, the attacker could briefly bypass the "Think/Do" separation, enabling the agent to accept arbitrary instructions before its state could be re-verified. This allowed for similar unauthorized control, albeit through a more intricate exploit mechanism.
Comparable vulnerabilities were also demonstrated against Opera Neon and Anthropic’s Claude when installed as a Chrome extension. The latter case is particularly noteworthy as Claude operates as a browser extension itself, highlighting that even AI capabilities delivered as extensions are not immune to such manipulation. This finding resonates with earlier discoveries, such as the weakness reported by Manifold Security where Claude for Chrome executed AI workflows on synthetic clicks without proper user verification, and the "ClaudeBleed" flaw disclosed by LayerX, where the extension trusted the claude.ai origin without adequately validating the script driving it. These precedents collectively paint a picture of ongoing challenges in securing AI-powered browser components.
"Prompt Forcing": A New Paradigm in AI Exploitation
Weizman’s research introduces the concept of "Prompt Forcing," a technique distinct from traditional "prompt injection." While prompt injection involves subtly embedding malicious instructions within content that an AI is already processing (e.g., a carefully crafted email subject line that an AI assistant might summarize), Prompt Forcing grants the attacker complete control. With Prompt Forcing, the malicious extension can directly supply the AI agent with an entire, comprehensive prompt, along with subsequent instructions and commands. The AI agent then dutifully translates these attacker-provided directives into legitimate browser actions, leveraging its pre-existing and often extensive privileges.
This distinction is crucial for endpoint security defenses. Unlike conventional malware, where the final malicious action is typically carried out by rogue code, Prompt Forcing manipulates legitimate, trusted software components (the AI agent and its browser "body") into performing the attack. This makes detection and attribution significantly more challenging, as security solutions may struggle to differentiate between legitimate AI-driven actions and those coerced by a malicious extension. The fact that the "legitimate software is being told to perform the attack" represents a significant evolution in the threat landscape.
Implications for Browser Security and Future Defenses
The BragJack revelations point to a burgeoning and critical challenge as browsers and other endpoint applications increasingly integrate sophisticated AI agents. What was once considered a relatively contained risk – a compromised extension primarily limited to manipulating web content – can now, in certain architectural designs, become a conduit to software that can read sensitive local files, access browsing data, and execute arbitrary actions on websites on behalf of the user. This necessitates a fundamental re-evaluation of trust models within browser architectures. The implicit trust placed in browser extensions to interact with web content must now extend to their potential influence over highly privileged AI components.
For users, the immediate implications underscore the importance of stringent security hygiene. This includes keeping browsers fully updated to ensure patches for vulnerabilities like BragJack are applied promptly. Furthermore, users should exercise extreme caution when installing browser extensions, rigorously reviewing their requested permissions, and immediately removing any extensions that are unfamiliar, no longer used, or seem suspicious. Broad "read and change all your data on all websites" permission prompts, though common, should be treated with heightened scrutiny.
For browser developers and AI integrators, the research serves as a stark warning. Future designs for AI integration must prioritize robust security-by-design principles. This includes stronger sandboxing mechanisms for AI components, more granular privilege separation, rigorous input validation for AI agents, and continuous auditing of how extensions can interact with or influence these agents. The reliance on declarativeNetRequest as an attack vector also highlights the need for careful consideration of how powerful browser APIs can be abused, even when not directly targeting a component. The security community will need to collaborate closely to establish new best practices and architectural patterns that mitigate these emerging threats, ensuring that the benefits of AI integration do not come at the expense of user security and privacy.
Weizman’s comprehensive technical breakdown, available alongside his initial writeup, provides invaluable insights for security professionals and developers aiming to understand and defend against this new class of attack. BragJack stands as a pivotal moment in browser security, signaling the urgent need for proactive, adaptive defense strategies in an era where AI is becoming an integral, and potentially vulnerable, part of our digital experience.
Aura Kasih
Ayu Aulia
