Weizman's BragJack hijacks five Chromium AI assistants from a single installed extension
Gal Weizman showed that one malicious extension can take over the AI agents in Chrome, Comet, Edge, Neon and Claude in Chrome, with bounties from all five vendors to show for it. Installation is the only precondition.
The Watch · Security desk
What happened
- Gal Weizman of Forever Security demonstrated BragJack against five Chromium targets: Chrome's Gemini Live, Perplexity Comet, Microsoft Edge, Opera Neon and Anthropic's Claude in Chrome.
- One extension worked on all five, relying on Chromium's declarativeNetRequest rules, which let it change response headers and redirect the resources those privileged AI components load.
- The extension has to be installed first, but after that the abuse runs with no user interaction and inherits the agent's existing privileges to read data or act as the victim.
- Chrome's finding, CVE-2026-0628, drew a $7,000 bounty and reached local files, web content, screenshots and potentially the browser's camera and microphone.
- In Comet, Weizman drove the built-in agent to visit Perplexity, summarize the victim's emails and send the results to another address.
Why it matters
- What's now possible capability The permissions a user approves no longer bound what an extension can reach: a rule-based network-request extension ends up exercising file reads, screenshots and agent instructions it never requested.
- Who has to decide decision Fleets that turn on in-browser agents have to treat the extension allowlist as the control separating an attacker from agent privileges, because installation is the whole precondition.
- Who's exposed exposure Users of Comet, Neon and Claude in Chrome hold the residual risk, since three of the five findings have neither a public identifier nor a reported fix.
- What it sets up precedent Claude for Chrome has produced three disclosures of the same origin-trust class, so a single patch is a weak basis for assuming the agent-extension boundary now holds.
Next story · Product · 11h ago
ChatGPT's Chrome extension can read your open tabs and, in Work, act on themConfirmed4 publishers
Extensions were blocked from touching the privileged chrome://glic component and from injecting scripts into Google's Gemini site, but declarativeNetRequest rules could still intercept the requests the embedded Gemini web app made [7]. Weizman weakened security headers and redirected a JavaScript resource [8]. His code then ran inside the Gemini context and spoke to Chrome's privileged AI component directly, skipping Gemini's normal request flow [8]. Weizman says that access could read local files, reach web content, take screenshots and potentially reach the browser's camera and microphone [9].
Comet's built-in agent extension trusted several Perplexity domains, one of them a testing domain that had not been given the protections applied to the primary perplexity.ai site [14]. Removing a redirect to that domain with a DNR rule was enough to load it and inject a content script able to talk to the agent [14].
Microsoft had already built a defence against this shape of abuse: it split the Edge agent into "Think" and "Do" modes so the agent could not take arbitrary instructions and actions at the same time [16]. Weizman found a race condition that briefly disables the restriction while a prompt is forced, then re-enables the action capability before the agent checks its state [17]. Microsoft assigned CVE-2026-55945 [17].
The five vendors paid more than $20,000, in a range from $600 to $7,000 [3]. Chrome's CVE-2026-0628 drew the top of that range at $7,000 [10], leaving more than $13,000 across the other four, better than $3,250 each [21]. Two CVEs came out of five vendor findings [3]. The report says Google and Microsoft have resolved the flaws they were assigned [13]; the other three findings carry no public identifier and no reported fix [22].
Claude in Chrome is the one target that is itself an extension [11], and it has history here. LayerX disclosed ClaudeBleed in April: the extension trusted the claude.ai origin instead of checking which script was actually driving it [19]. The author of the BleepingComputer account, who reported a related weakness while working at Manifold Security, says the extension ran its built-in AI workflows on synthetic clicks without verifying they came from a real user, and that the flagged code was still reproducible eight releases later [18].
Weizman calls the seizure technique Prompt Forcing and distinguishes it from conventional prompt injection [20]. In his writeup he describes these systems as having a "brain" and a "body", with the model deciding what should happen and a privileged browser component accessing tabs, reading content, taking screenshots and interacting with sites [4].
All five chains start with the extension already installed in the victim's browser [12], and after that nothing requires the user to click [24]. So the install decision settles the outcome. Where Chrome or Edge policy limits installs to an allowlist, the technique has no starting point; where users install what they like, an extension whose declared job is rewriting network requests [6] can end up reading local files, taking screenshots and issuing instructions to an agent that acts on the victim's behalf [24].
What to watch
- Whether Perplexity, Opera and Anthropic ship fixes for the three findings that have no published CVE.
- Whether Chromium restricts what DNR rules can do to requests issued by privileged in-browser AI components.
- Whether Microsoft adds a state check that closes the Think/Do race in Edge, or regates the action capability entirely.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence68
- Adoption
- Not scored
- Hype gap+30
- Incentives62
- Confidence64
Perspective Coverage
3 publishers- Builder
- Builder 54%
- Operator
- Operator 38%
- Investor
- Investor 8%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Security researcher Gal Weizman of Forever Security disclosed an attack technique that can hijack the AI assistants built into popular browsers using a single malicious browser extension.
- [2]
The technique is dubbed BragJack; the proof of concept was demonstrated against five Chromium-based browsers or browser assistants: Google Chrome's Gemini Live, Perplexity Comet, Microsoft Edge, Opera Neon, and Anthropic's Claude in Chrome.
- [3]
The research earned more than $20,000 in bug bounties from the five vendors, ranging from $600 to $7,000, and produced two CVEs.
- [4]
In his writeup Weizman describes these systems as having a "brain" and a "body": the AI model processes instructions and decides what should happen, and a privileged browser component then performs the actions, such as accessing tabs, reading content, taking screenshots, or interacting with websites.
- [5]
According to Weizman, the problem is that browser extensions can manipulate web traffic and pages that these privileged components trust.
- [6]
The same extension was used across all five targets, relying on Chromium's declarativeNetRequest functionality, which lets extensions modify how network requests are handled, including changing response headers and redirecting resources.
- [7]
In the Chrome attack, extensions were blocked from directly touching the privileged chrome://glic component or injecting scripts into Google's Gemini site, but DNR rules could still intercept requests made by the embedded Gemini web app.
- [8]
By weakening security headers and redirecting a JavaScript resource, Weizman executed code inside the Gemini context, communicating directly with Chrome's privileged AI component rather than going through Gemini's normal request flow.
- [9]
Weizman says the resulting access could read local files, reach web content, take screenshots, and potentially reach the browser's camera and microphone.
- [10]
Chrome assigned the finding CVE-2026-0628 and paid a $7,000 bounty.
- [11]
Similar flaws were demonstrated against Opera Neon and Claude in Chrome, though the latter is itself a browser extension rather than a browser.
- [12]
The attack requires the malicious extension to already be installed in the victim's browser.
- [13]
Both Google and Microsoft have since resolved the flaws they were assigned.
- [14]
For Comet, Weizman found the browser's built-in agent extension trusted several Perplexity domains, including a testing domain that did not get the same protections as the primary perplexity.ai site; by removing a redirect to that domain with DNR he loaded it and injected a content script able to talk to the built-in agent.
- [15]
The Comet access included browsing history, screenshots, local files, and the ability to send instructions to the agent; Weizman demonstrated forcing the agent to visit Perplexity, summarize the victim's emails, and send the results to another address.
- [16]
Microsoft had split its Edge agent into "Think" and "Do" modes to stop it from taking arbitrary instructions and actions at the same time.
- [17]
Weizman found a race condition that briefly disables the Edge restriction while forcing a prompt, then re-enables the action capability before the agent checks its state; Microsoft assigned CVE-2026-55945 to the race condition.
- [18]
The author of the BleepingComputer report says that in work at Manifold Security they reported a related weakness in Claude for Chrome: the extension ran its built-in AI workflows on synthetic clicks without verifying they came from a real user, and the flagged code was still reproducible eight releases later.
- [19]
LayerX disclosed ClaudeBleed in April, an earlier flaw in the Claude for Chrome extension in which it trusted the claude.ai origin rather than checking which script was actually driving it.
- [20]
Weizman calls the technique used to seize these agents Prompt Forcing, and distinguishes it from conventional prompt injection, in which an attacker tries to slip malicious instructions in.
- [21]
With Chrome's $7,000 at the top of the $600 to $7,000 range, the other four vendors paid more than $13,000 between them, an average above $3,250 each.
- [22]
Two CVEs across five demonstrated vendor targets leaves three findings without a public identifier in the report.
- [23]
Claude for Chrome has now had three separate disclosed weaknesses in this class: ClaudeBleed in April, the synthetic-click workflow issue, and the BragJack demonstration.
- [24]
Once the extension is installed, the abuse can run without user interaction, letting the extension control an AI browser agent and abuse its existing privileges to access sensitive information or act on the victim's behalf.
Sources
3 independent publishers whose own reporting we read for this story.
- bleepingcomputer.comBragJack attacks hijack AI browser agents through malicious extensions
1 article · September 19, 2026
- Forever Security
forever.security
1 article · September 20, 2026
- thehackernews.comOne Extension Could Hijack AI Assistants Across Chrome, Comet, Edge, Opera Neon and Claude
1 article · September 17, 2026
Topics and entities
Entities
- Forever Security
- Manifold Security
- Microsoft Edge
- Google Chrome
- declarativeNetRequest
- Perplexity
- Perplexity Comet
- Claude in Chrome
- Anthropic