BragJack: one browser extension hijacks the AI agents in five major browsers

On 16 September 2026 Gal Weizman, a security researcher at Forever Security, published BragJack: a proof of concept in which one ordinary browser extension — no zero-day, no jailbroken model, no compromised vendor server — took control of the AI agents built into five Chromium-based products, Gemini Live in Google Chrome, Copilot in Microsoft Edge, Opera Neon, Perplexity Comet and Claude in Chrome. The extension asked for nothing exotic. It used content scripts and Chromium's declarativeNetRequest API, the same two permissions that sit in most ad blockers, to reach the private channel each vendor's own website uses to send instructions to its agent. Weizman reports that Comet was the broadest compromise, that Google and Microsoft shipped fixes and assigned CVE-2026-0628 and CVE-2026-55945, and that no attacks in the wild have been observed. It is catalogued as a vulnerability, severity high, in the AI incident archive, where each record carries its sources, confidence grade and disputed flag.

The extension did not break the model. It broke the channel.

Every one of the five products is built the same way, according to the technical companion Forever Security published the same day. Each has a "body" inside the browser that can open tabs, read local files, take screenshots and click on pages, and a "brain" outside the browser that decides what the body should do — Google's Gemini servers for Chrome, the perplexity.ai web app for Comet, copilot.microsoft.com for Edge, Anthropic's backend for Claude in Chrome. The body is designed to accept instructions from exactly one origin: the vendor's own website. That single trusted origin is the whole security model. It is also the thing a browser extension is allowed to touch.

Chromium grants any installed extension two powers that are close to universal. A content script lets it run JavaScript inside a page. The declarativeNetRequest API, or DNR, lets it rewrite network traffic — remove a response header, redirect a script request to a different server. Browsers spend real effort keeping those two powers away from privileged surfaces, and four of the five vendors had done part of that work. What Weizman found, in each case, was a gap in the part they had left open.

He calls the general technique DinNeR Serving: use DNR to weaken the security headers of a trusted page, then use DNR again to redirect one of that page's script requests to a server the attacker controls. The page now runs attacker code, but it still believes it is the vendor's page, and the agent still believes it is hearing from the vendor. In Chrome, Weizman reports that extensions were correctly blocked from attaching a content script or a debugger to the embedded Gemini app, and that DNR was the one mechanism Chromium had not extended the same protection to inside a WebView. Stripping the Content-Security-Policy and relaxing the document isolation policy was enough to swap a script served from gstatic.com for his own, and from inside chrome://glic he could then post the browser agent's own message types directly — create a tab at a file:/// address, read it back as text, PDF or screenshot, and pull the signed-in profile's email address and picture.

What the same extension did, browser by browser

The extension was not five tools. It was one manifest that asked for declarativeNetRequest and broad host access, plus a separate rules file for each target; only the rules changed between attacks. Forever Security's own table is the clearest summary of what each chain reached, and it is reproduced below. The row that matters most is Agent hijack: in four of the five, the demonstrated outcome was not data theft but control of an agent that could act on the user's behalf inside logged-in sessions.

Those per-browser chains are the part of BragJack that no second party has checked. BleepingComputer, Cyber Security News, the Cloud Security Alliance and Thailand's national CERT all reported the disclosure, and all of them describe the mechanics the same way, but every one of them is describing Forever Security's write-up rather than testing it. The ThaiCERT notice of 21 September 2026 cites BleepingComputer as its source. What follows is therefore Weizman's account of his own proof of concept, which is what a disclosure is, and not an independently reproduced result.

Perplexity Comet: a test domain still on the trust list

Comet was the worst of the five by the researcher's own ranking, and the reason is structural rather than a coding slip. Perplexity built a browser in which the agent holds the browser's own permissions, so a hijacked agent inherits all of them. Perplexity had also done the defensive work that the others had skipped: extensions are blocked from running on perplexity.ai entirely, which is why Weizman says ad blockers do not work there.

The gap was in the agent extension's list of origins it would accept commands from. According to the technical write-up, that list held ten entries, not one — perplexity.ai and its www variant, plus testing, staging and preview hosts on both perplexity.com and perplexity.ai. Only the production hosts had been hardened. testing.perplexity.com still accepted content scripts. The remaining obstacle was that every one of those domains answered with a 302 redirect to perplexity.ai, so the browser never landed on the test page long enough for a script to attach. A DNR rule that deletes the Location header removes that obstacle, and the content script can then speak to the agent extension directly through the runtime messaging channel it exposes.

What the agent would do on request, per Weizman, was list the browsing history, open arbitrary URLs including file:/// paths, and take screenshots of visible tabs — and then, through a command that starts an agent run from a supplied prompt, do almost anything a user could do. His demonstration prompt asked Comet to visit perplexity.ai, summarize the last five emails and send the summary to a second address. He also reports that file:/// access had been addressed in an earlier Comet disclosure but that the fix was case-sensitive, so FiLe:///etc/hosts still worked. None of that appears in any Perplexity advisory; the company paid a bounty and, according to Forever Security, remediated the behaviour it was shown.

Microsoft Edge: a marketing page, a synthetic click and a race

Edge was the only target that fought back, and it is the most instructive of the five. Microsoft had split its agent into a "Think" mode that accepts prompts and a "Do" mode that acts on pages, with the two deliberately unable to run at once — a real safety mechanism, and one that stops prompt forcing by construction. Microsoft had also hardened the marketing page at microsoft.com/edge that demonstrates the agent, gating its privileged prompt-sending function on three separate conditions: a Content-Security-Policy that could not simply be deleted, because the privileged object is never created when the header is missing, a fresh user-gesture token, and a function that populates the prompt box rather than sending it.

Weizman's account is that each condition fell to a different trick. Instead of deleting the CSP he widened its frame-ancestors directive to permit embedding by any .com site. For the gesture token he added the debugger permission to the manifest and dispatched a synthetic click, which Chromium accepts as an organic gesture. For the race, he disabled the agent tools flag, called the prompt-sending function, then re-enabled the flag while the agent was still deciding whether it was allowed to act. The setting was off at the moment the prompt was forced and on at the moment the permission check ran. That is what Microsoft assigned CVE-2026-55945 to.

The money matches the work: Forever Security records $3,000 for the Edge Chromium finding and $2,000 for the race condition, $5,000 in total — third of the five, behind the $7,000 each from Google and Perplexity.

Opera Neon and Claude in Chrome: the two easy ones

Opera Neon required the least of the five. Its agent takes orders from opera.com, and unlike Google and Perplexity, which both blocked extensions from attaching content scripts to their agent's trusted origin, Opera had not stopped extensions from attaching a content script to that domain, so Weizman's extension could inject a script there and call the agent's message channel directly with whatever prompt it liked. Dropping the CSP made the same attack embeddable in an invisible frame on any page. His write-up adds one detail that is not in anyone else's coverage: Opera told him it had found the flaw independently at around the same time, and paid the $900 bounty anyway. That is a vendor claim reported by the researcher, not a finding either party has published evidence for.

Claude in Chrome is the odd case, because it is an extension rather than a browser, and Forever Security says so plainly: one extension exploiting another is a smaller risk than an extension exploiting the browser it runs in. The mechanism was a marketing page on claude.ai that could pass arbitrary prompts to the side panel, combined with a content script that fired on clicks to an onboarding button and read the prompt out of a data attribute. Weizman set the page body's id and attribute himself, dispatched a synthetic click through the debugger permission, and the side panel opened with his prompt in it. Anthropic rated it medium severity, paid a bounty, and according to Forever Security acknowledged the company as the first to report this particular finding. The two Forever posts disagree slightly on the amount — $600 in the main table, $500 in the technical companion.

What the vendors' own records actually say

Only two of the five produced a public vulnerability record, and both of them predate the BragJack write-up by months. Google's stable-channel release note for 6 January 2026 lists "High CVE-2026-0628: Insufficient policy enforcement in WebView tag. Reported by Gal Weizman on 2025-11-23", and names 143.0.7499.192/.193 for Windows and Mac and 143.0.7499.192 for Linux. The National Vulnerability Database entry, published 7 January 2026, describes the flaw as allowing an attacker "who convinced a user to install a malicious extension to inject scripts or HTML into a privileged page via a crafted Chrome Extension", classifies it as CWE-862, missing authorization, and carries a CVSS 3.1 score of 8.8. That score is not Google's: it comes from CISA's enrichment of the record, as The Hacker News noted, and Google's own note rates the issue High.

Microsoft's record is narrower still. CVE-2026-55945, published 3 July 2026, is a CWE-362 race condition with a CVSS 3.1 score of 4.2, severity Moderate. Microsoft's impact statement is "Information Disclosure", and its own FAQ says the information disclosed is file content. The fixed build is 150.0.4078.48, released the same day, and the record's exploit status reads "Publicly Disclosed: No; Exploited: No". Nothing in that document describes an agent being driven across arbitrary websites, which is the impact Weizman reports. Both statements can be true at once — the CVE covers the race condition, while the marketing-page capability was a second finding paid separately — but no vendor document published so far describes the end-to-end chain.

"Zero clicks" means after the extension is installed

The phrase in Forever Security's table is accurate and easy to misread. BragJack is not a drive-by. BleepingComputer, the Cloud Security Alliance and ThaiCERT all lead with the same precondition: the malicious extension has to be installed already. What the research shows is that once it is, no further click is needed — the extension reaches the agent on whatever page the user happens to be on, with nothing displayed. For Comet and Opera Neon that required no interaction at all; for Edge and Claude in Chrome the click the agent demanded was synthesized by the extension through the debugger permission, so the user did not supply it either.

That distinction sets the real-world exposure. The attack needs either a user who installs something malicious or an extension already trusted in the store that turns malicious later, and neither is a high bar — which is why CSA's recommendations centre on extension inventory and on treating declarativeNetRequest and debugger permissions as privileged. It is also why nobody has reported an attack: a proof of concept that needs a hostile extension installed is a demonstration of a capability, not a campaign.

Prompt forcing, and the sales argument attached to it

The terminology matters because it describes where the defences sat. Prompt injection hides instructions in content a model is already reading; the model's training and filters are the intended backstop. What Weizman did was write the entire prompt, choose the moment it arrived, and keep sending follow-ups — from an origin the agent was built to trust. Model-level safety filtering never becomes relevant, because nothing in the exchange looks like an attack. Forever Security calls this prompt forcing.

The corollary the company draws is that endpoint detection cannot see it either, since no malicious code runs: legitimate software is being told to do something it is permitted to do. That claim arrives attached to a product pitch — Forever Security sells an AI-native endpoint agent, and both write-ups close by recommending it. The observation that a hijacked agent produces no malware signature does not depend on buying anything, but it is the researcher's argument rather than a measured result, and no independent party has tested whether an endpoint product of any kind detects these chains.

What is established, and what rests on one researcher

The archive files this entry as a vulnerability, severity high, region global, confidence B — documented, but from a single or secondary source — not disputed, with no real harm recorded. That grade describes the evidence rather than the severity of the bugs, and the split runs cleanly through the story.

Established, in the sense that a vendor or a first-party record says it:

• Google shipped a Chrome fix on 6 January 2026 in 143.0.7499.192 and .193, and credited Gal Weizman with a report dated 23 November 2025. This is in Google's own release note, not in the researcher's account of it.

• CVE-2026-0628 exists, is rated High by Google and 8.8 by CISA's enrichment in the NVD record, and is classified as insufficient policy enforcement in a WebView tag.

• Microsoft published CVE-2026-55945 on 3 July 2026 as a Moderate 4.2 race condition leading to information disclosure, fixed in Edge 150.0.4078.48, with exploitation recorded as none.

• CISA's SSVC assessments in both NVD records say "exploitation: none", and nobody — vendor, researcher or reporter — has claimed an in-the-wild attack. That is an absence of reporting, which is not the same as proof of absence, but it is the state of the record six weeks after publication.

Resting on Forever Security's account alone:

• Every per-browser exploit chain, including the DNR rule sets, the testing.perplexity.com redirect removal, the Edge marketing-page sequence and the Claude onboarding-button click. The CVEs describe two mechanisms; they do not describe these chains.

• The full impact list for Comet — browsing history, local file reads, profile data, screenshots — and the specific claim that a hijacked Comet agent could be told in plain English to summarize and forward email. BleepingComputer reports it as the researcher's demonstration; no Perplexity statement confirms or disputes it.

• Chrome's camera and microphone access, which BleepingComputer describes as "potentially" reachable and the Forever table lists as achieved.

• The bounty total. Forever Security states about $20,000 across five vendors; its own per-product figures add up to $20,500, an arithmetic point The Hacker News also made. The Claude in Chrome figure differs between the company's two posts. BleepingComputer's "more than $20,000" is consistent with either reading.

• That prompt forcing is a new class of attack rather than a name for a family of authorization bugs. That is a framing claim, and the Cloud Security Alliance — which adopted it — describes the underlying pattern as an architectural gap shared across vendors, not a new technique with its own mechanics.

Three of the five vendors never published a vulnerability record at all. CSA notes that Perplexity, Opera and Anthropic acknowledged and remediated the specific proof of concept without advisories comparable to Google's and Microsoft's, and Forever Security gives no fix dates for those three. No independent reproduction of any BragJack chain has been published; Cyber Security News and ThaiCERT both restate the disclosure, and ThaiCERT cites BleepingComputer.

What changed after the disclosure

For Chrome and Edge users the practical answer is that nothing needed to change on 16 September: the fixes shipped in January and July, and anyone on Chrome 143.0.7499.192 or later, or Edge 150.0.4078.48 or later, was already patched. That timing is worth sitting with. The bugs were closed months before the technique that bound them together had a name, which is the normal shape of coordinated disclosure and also the reason the headline reads worse than the patch state.

For Comet, Opera Neon and Claude in Chrome the position is less clear. Each vendor paid a bounty and, according to Forever Security and CSA, addressed the behaviour demonstrated. None published a version-pinned advisory or a date, so there is no build number a user can check against, only the general instruction to stay current. CSA's guidance for organisations is to inventory extensions with declarativeNetRequest or debugger permissions, restrict agentic browsers to profiles without authenticated sessions to email, code or finance, and ask vendors how they separate synthetic from genuine user input. BleepingComputer's advice for individuals is simpler: keep the browser updated, remove extensions you do not recognise, and treat "read and change all your data on all websites" as the warning it is.

The unresolved question is not whether five bugs were fixed. It is whether the design assumption behind them was. Every one of these products treated a first-party web origin as a trustworthy place for a privileged local agent to take orders, in a browser where any installed extension can rewrite what that origin says. Forever Security argues the fix is endpoint-level monitoring; CSA argues for origin validation, least privilege, isolated command channels and unforgeable input provenance. None of the five vendors has said publicly, in any record reviewed for this piece, that it changed the architecture rather than the specific path Weizman walked.

The record's date is the date of the explanation, not the date of the bugs — and that gap is the story. A single extension, two permissions that ad blockers have held for years, and five vendors who each believed their own website was the one place an attacker could not stand.