BragJack: A Malicious Extension Hijacks Five AI Agents in Chromium Browsers

Gal Weizman of Forever Security has disclosed BragJack, a proof-of-concept that exploits Chromium's declarativeNetRequest API to take control of AI agents integrated into five different browsers. The research, made public on September 16, 2026, demonstrates that installing a seemingly innocuous extension is enough to expose Gemini Live, Perplexity Comet, Microsoft Edge, Opera Neon, and Claude in Chrome to manipulation without further user interaction. The result undermines the architectural assumption underpinning the new browser-based AI assistants: the separation between the remote model and the local component that executes actions.

How the Attack Works: The DNR Channel as a Privileged Vector

BragJack exploits an architectural design choice in Chromium. The declarativeNetRequest (DNR) API allows extensions to intercept and modify HTTP traffic without requiring exceptional permissions. Weizman demonstrated that this capability, combined with script injection into pages, enables manipulation of the responses the browser exchanges with AI servers. The agent's "body" component — the one that executes actions in the browser with elevated privileges — receives instructions it interprets as legitimate.

The core technique has been dubbed Prompt Forcing. According to Weizman's explanation to BleepingComputer, "unlike conventional prompt injection, where an attacker tries to slip malicious instructions into content the AI is already reading, Prompt Forcing allows the attacker to deliver an entire prompt and subsequent instructions to the agent. The agent translates those instructions into legitimate browser actions using its existing privileges." This shift — from inserting hidden instructions to completely taking over the command flow — makes the attack invisible to defenses that look for content anomalies.

The evidence map confirms the malicious extension requires only two standard permissions: the ability to modify pages and access to declarativeNetRequest. Both are common among legitimate extensions. The Hacker News verified that for all five platforms tested "no clicks are required" after initial installation.

Differentiated Impacts: Five Products, Five Attack Surfaces

The research did not produce a uniform vulnerability. The capabilities obtained by the attacker vary significantly by product, as documented by the comparative table published by The Hacker News.

Perplexity Comet emerged as the most severe case. The malicious extension can read local files, control the AI agent, exfiltrate browsing history, and capture screenshots. Forever Security exploited an unprotected domain for testing — testing.perplexity.com — which presented lower security guarantees than the main site. In Chrome, beyond agent control and local file reading, the attack gains access to camera and microphone.

Microsoft Edge required additional complexity. The Think/Do separation introduced by Microsoft — which isolates the decision-making component from the executive one — was bypassed through a race condition. The official Microsoft advisory for CVE-2026-55945 describes the vulnerability as "Concurrent execution using shared resource with improper synchronization," with CVSS vector:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N. The 4.2 score reflects local access and attack complexity, not the potential magnitude of damage.

For Claude in Chrome the severity is lower: one extension abuses another extension, not a native browser component. Anthropic paid the lowest bounty in the series, $600. Opera Neon received no official CVE, and sources do not specify whether the vulnerability has been fixed.

Bug Bounty and Patches: The Systemic Delay

Forever Security obtained over $20,000 in bug bounties for the research. The Hacker News reports a per-product sum amounting to $20,500, with payments ranging from $600 to $7,000. Google and Perplexity both paid the maximum, $7,000, respectively for Chrome and Comet.

"The common thread is that putting an AI agent inside the browser reopens a path that browsers struggle to close, allowing a low-privilege extension to reach a high-privilege part of the browser." — Forever Security (via The Hacker News)

Confirmed patches arrive from two vendors. Google fixed Chrome in version 143.0.7499.192, with a fix dating back to January 2026 according to The Hacker News. Microsoft released Edge version 150.0.4078.48 on July 2, 2026. For Comet, Opera Neon, and Claude in Chrome, no fix dates emerge from available sources. This discontinuity is significant: the systemic problem — the DNR attack surface as a control channel — has not been addressed in the shared Chromium architecture.

What to Do Now

• Audit installed extensions in enterprise browsers, with particular attention to those requesting the "declarativeNetRequest" and "access to data on all websites" permissions. These two permissions combined constitute the exact prerequisite for the BragJack attack.
• Prioritize installation of extensions only from official stores with active editorial review, recognizing that this filter is not sufficient: the demonstrated attack starts from an already-installed extension, not necessarily malicious at the time of download.
• Evaluate separation between generic browsing environments and those hosting AI agents with extended privileges, particularly where the agent has access to local files, camera, or microphone.
• Monitor Chrome and Edge versions to confirm application of patches 143.0.7499.192 and 150.0.4078.48, and request clarification from Perplexity, Opera, and Anthropic on the status of fixes for their respective products.

Why the Browser Trust Model No Longer Holds

BragJack is not a zero-day exploit in the traditional sense. It exploits an existing, documented, widely granted permission. The problem is that AI agent integration has changed the value of what that permission allows reaching. An extension that intercepts HTTP traffic was previously a threat to privacy or credential theft. Now it can become a vector for executing complex actions — transfers, document modifications, environmental surveillance — through an AI intermediary the system considers trusted.

The race condition in Edge is particularly instructive. Microsoft had recognized the architectural risk and attempted to mitigate it with the Think/Do separation. The bypass demonstrates that structural guarantees do not hold if the communication channel between the two components is not protected against timed manipulation. The lesson extends beyond individual vendors: any browser that implements an AI agent with a local executive component inherits the same tension between flexibility and control.

Sources do not document in-the-wild exploits as of September 16, 2026. This does not diminish the relevance of the proof-of-concept. Threat actors operating with browser extensions — documented in campaigns like the KREMLIN malware reported separately by Elastic — already possess the distribution infrastructure. Adding Prompt Forcing as a command-and-control technique requires no additional sophisticated capabilities, only adaptation of the payload to the target agent's API.

Frequently Asked Questions

Why did only Chrome and Edge receive official CVEs?

The CVE process assigns identifiers through vendors' CNAs (CVE Numbering Authorities). Google and Microsoft have their own CNAs and formally acknowledged the vulnerabilities. For Comet, Opera Neon, and Claude in Chrome, no CVE assignments emerge from available sources, without implying these products are immune.

The attack requires the victim to install a malicious extension: isn't that a limited vector?

The limitation is real but not reassuring. Malicious extension distribution campaigns are documented and active. BragJack's qualitative point is that, once that initial barrier is cleared, the attack requires no further interaction or advanced technical skills. The extension operates in the background exploiting already-granted permissions.

Does a Chromium patch fix the problem for all Chromium-based browsers?

No. Chrome received a patch in January 2026, but Opera Neon — also Chromium-based — has no declared fix in sources. Additionally, the Edge vulnerability (CVE-2026-55945) is specific to Microsoft's implementation. The DNR attack surface persists in the shared architecture, and every vendor integrating an AI agent must independently assess exposure.

Sources

• https://www.bleepingcomputer.com/news/security/bragjack-attacks-hijack-ai-browser-agents-through-malicious-extensions/
• https://thehackernews.com/2026/09/one-extension-could-hijack-ai.html
• https://thehackernews.com/2026/09/kremlin-banking-malware-hijacks-chrome.html
• https://www.elastic.co/security-labs/threat-command/malicious-browser-extension-kremlin-banking-malware
• https://daily.dev/posts/bragjack-attacks-hijack-ai-browser-agents-through-malicious-extensions-tgnh2pcif
• https://www.techrepublic.com/article/ai-expansion-robot-factories-and-escalating-security-threats-define-this-week-in-tech/
• https://nvd.nist.gov/vuln/detail/CVE-2026-0628
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55945
• https://www.bleepingcomputer.com/
• https://www.bleepingcomputer.com/tutorials/

Information verified against cited sources and current as of publication.

Sources