Security researcher Gal Weizman of Forever Security has disclosed BragJack, a proof-of-concept attack technique that lets a single malicious browser extension hijack the agentic AI assistants now built into five major browsers: Google Chrome (Gemini), Microsoft Edge (Copilot), Opera Neon, Perplexity Comet, and Claude in Chrome. The research, published September 19, earned Weizman more than $20,000 in combined bounties and produced two confirmed CVEs.

What happened

Modern agentic browsers split responsibilities into what Weizman describes as a “brain” and a “body.” The AI model is the brain — it reasons over instructions and decides what should happen next. A privileged browser component is the body — it actually executes those decisions: opening tabs, reading page content, taking screenshots, clicking elements, and interacting with authenticated sites on the user’s behalf. That privileged body normally only takes commands from the trusted AI brain, not from arbitrary web content or extensions.

BragJack breaks that boundary. Rather than trying to jailbreak the model with clever prompts or hide instructions inside a web page (classic prompt-injection), Weizman found that an ordinary, low-privilege browser extension could reach past the brain entirely and hand commands directly to the privileged execution layer — impersonating the AI agent itself. The extension needed no unusual permissions beyond what ad blockers and productivity tools request every day: content scripts and the declarativeNetRequest (DNR) API, which lets an extension inspect and modify network requests.

Using those ordinary capabilities, the malicious extension was able to force the agent to browse to attacker-chosen sites, summarize the victim’s private emails and exfiltrate the results to an external address, take screenshots, and access local files — all without any additional user interaction once the extension was installed. In one demonstration, Weizman forced an agent to visit Perplexity, pull data from the victim’s inbox, and send it off-device.

Technical details

Each of the five browsers implemented the brain/body split slightly differently, producing five separate exploitation paths under the same architectural flaw:

  • Chrome (Gemini) — tracked as CVE-2026-0628 (CVSS 8.8, High), a WebView policy bypass that let the extension’s injected commands slip past the boundary meant to isolate untrusted content from the agent’s action layer. Patched in Chrome 143.0.7499.192.
  • Edge (Copilot) — tracked as CVE-2026-55945 (CVSS 4.2, Medium), a race condition where a restriction that should block the agent from taking privileged actions is briefly disabled while a permission prompt is being forced, then re-enabled after the action already executed — the check runs after the fact instead of before. Patched in Edge 150.0.4078.48.
  • Opera Neon, Perplexity Comet, and Claude in Chrome — Weizman reported comparable extension-to-agent boundary failures in each. Google, Microsoft, and Anthropic have all resolved the issues raised against their products; Opera and Perplexity shipped their own fixes. No CVE identifiers were assigned for these three at time of publication.

Bounty payouts ranged from $600 to $7,000 per finding across the five vendors.

Impact

Any user who installs a malicious or later-compromised extension — including one that looked benign at install time and shipped harmful updates afterward — is exposed if their browser runs an agentic AI assistant with standing access to tabs, screenshots, files, or authenticated sessions. Because the exploit works through permissions extensions routinely request, existing extension review processes and permission prompts don’t reliably catch it. The technique generalizes beyond the five products tested: any browser vendor bolting an AI agent onto an extension-based architecture without hardening the boundary between untrusted extension code and the agent’s privileged action layer is a candidate for the same class of bug.

Mitigation

Patches are available now for the two CVE-tracked issues — update to Chrome 143.0.7499.192+ and Edge 150.0.4078.48+. Anthropic, Opera, and Perplexity have also shipped fixes for their respective products; confirm you’re on current release channels for Claude in Chrome, Opera Neon, and Comet. Beyond patching, audit installed extensions for anything beyond what’s strictly necessary — particularly extensions requesting declarativeNetRequest, content-script injection, or broad host permissions — since these are the exact primitives BragJack abused. Enterprises deploying agentic browsers should treat the extension ecosystem as part of the AI agent’s trust boundary, not a separate concern, and restrict extension installation via managed policy where agentic features are enabled.

References: Forever Security’s full technical writeup, BleepingComputer’s coverage, Dark Reading’s report.