BragJack: one extension let researchers hijack the built-in AI agents of five browsers

Security researchers have demonstrated an attack, named BragJack, in which a single browser extension seizes control of the built-in AI agents shipped by major browser makers. In a technical overview published by Forever Security on 16 September and summarised on dev.to, the team describes hijacking Gemini inside Chrome, Copilot inside Microsoft Edge, Opera Neon, Perplexity's Comet browser and Claude in Chrome — either by invoking privileged browser functions directly or by forcing prompts onto the agent, a technique the researchers call prompt-forcing. Dark Reading reports that the vendors involved have since resolved the issues, and the cited sources describe no exploitation in the wild.

Four attack paths, one extension

The prerequisite in every scenario is an installed extension — malicious, or a legitimate one that has been compromised — holding specific permissions such as Declarative Net Request (DNR) rules and host access to the target site. What differs is how each product is tricked.

• Chrome with Gemini. The extension used DNR to weaken the Content Security Policy of the WebView that renders Gemini, redirecting requests for legitimate JavaScript to attacker-controlled code. Scripts then running on gemini.google.com issued commands to the privileged chrome://glic interface. In the proof of concept, local files, PDFs, screen captures, browser profile data and the camera and microphone were reached without any further user clicks — and without prompting the AI at all.

• Edge with Copilot. The extension injected a script into a Microsoft promotional page that is among the few permitted to send prompts to Copilot, loosened page-embedding restrictions with DNR, and used the debugger permission to synthesise click-equivalent events. It then force-sent a prompt while the agent was in Think mode and immediately switched to Do mode, exploiting a processing race condition. The PoC had the agent retrieve information and take actions on authenticated sites.

• Perplexity Comet and Opera Neon. Here the extension abused pages the browser trusts but that still permit script injection; in Comet, DNR stripped the HTTP Location header so a target page would load and run injected code able to talk to the built-in agent. The researchers sent initial prompts and follow-up prompts — the prompt-forcing at the heart of the attack — and had the agents read email and exfiltrate data.

• Claude in Chrome. The extension modified the claude.ai landing page to plant prompts that get passed into Claude's side panel, again combined with debugger-generated synthetic clicks so no real interaction was needed. Within Claude in Chrome's permission limits, the agent was instructed to retrieve information and act on authenticated sites.

What the PoCs do and don't prove

According to the overview, none of the demonstrations require user interaction once the extension is in place, and some used DNR to hide visible UI elements. Equally important is what they do not show: no compromise is demonstrated without the extension foothold, there is no reported real-world exploitation, and the suggestions for administrators — auditing extension IDs and permissions, correlating AI conversation logs with email and SaaS audit logs — are explicitly labelled as inference rather than tested detections.

Patched versions

Google and Microsoft have published advisories for the flaws: CVE-2026-0628 for Chrome and CVE-2026-55945 for Edge. According to those records, versions below Chrome 143.0.7499.192 and Edge 150.0.4078.48 are affected, and running a patched release closes the demonstrated paths. Dark Reading reports the issues have been resolved by the respective vendors.

Why it matters

Browsers are racing to ship agentic assistants that can read pages, manipulate tabs and act on signed-in services. BragJack shows that the seam between the web-facing AI and the privileged browser layer is itself attack surface, and an extension sitting in that seam can commandeer both sides. For defenders, three permissions — DNR, debugger access and broad host permissions — have quietly become agent-hijacking primitives rather than mere ad-blocking plumbing. And because these agents act inside the user's authenticated sessions, a compromised extension no longer just snoops on browsing; it can delegate data theft and unwanted site actions to a trusted assistant. Extension vetting, patch cadence and monitoring of agent-initiated activity all became more important this week.