BragJack: One Extension Hijacked AI Agents in 5 Browsers

On September 16, 2026, security researcher Gal Weizman of Forever Security published an attack he calls BragJack, showing that a single malicious browser extension can take control of the AI assistant built into five different browsers: Gemini in Google Chrome, Copilot in Microsoft Edge, Opera Neon, Perplexity Comet and Claude in Chrome. The extension never has to hide instructions in a web page. Using extension content scripts and Chromium's declarativeNetRequest API, it intercepts the traffic between the assistant and its backend and writes commands directly into the assistant's privileged context.

Weizman treats this as a distinct attack class, which he names Prompt Forcing. "What we did here is not prompt injection," he wrote — "we completely wrote and sent the entire prompt." In the proof-of-concept attacks described in his post, the hijacked assistant could read files from the local system, pull browser profile data and browsing history, capture screenshots, reach the microphone and camera, and summarize the user's email and send that summary out, with no interaction from the user.

The research is surfacing now because the vendor side is finally on the record. Forever Security lists the payouts as $7,000 from Chrome, $7,000 from Perplexity Comet, $5,000 from Microsoft Edge, $900 from Opera Neon and $600 for Claude in Chrome, or $20,500 combined; Cyber Security News, writing on September 19, described the combined figure as roughly $20,000. The browser-side holes were closed well before publication. The NVD record for CVE-2026-0628 describes insufficient policy enforcement in Chrome's WebView tag that let an attacker who convinced a user to install a malicious extension inject scripts or HTML into a privileged page; it carries a CVSS score of 8.8 (High), was fixed in Chrome 143.0.7499.192, and was published on January 7, 2026. CVE-2026-55945 covers a race condition in Microsoft Edge that allows local information disclosure, rated 4.2 (Medium) by Microsoft, fixed in Edge 150.0.4078.48 and published on July 3, 2026.

What matters here is the trust boundary, not the individual bugs. Browser makers are pushing assistants that read the page and act on the user's behalf to a mass audience, and that assistant is a privileged component sitting above ordinary web content. BragJack's point is that an extension the user installed months ago and forgot about lives on the same side of that boundary, and can speak to the agent with the browser's own authority rather than as an untrusted web page.

There are limits to what is known. Cyber Security News reported no evidence of exploitation in the wild, and the CISA-supplied assessments in both NVD entries list exploitation as "none" — this was a responsibly disclosed proof of concept. Opera, Perplexity and Anthropic all paid bounties, but no patched build numbers for Opera Neon, Perplexity Comet or Claude in Chrome have appeared in reporting so far. The practical step is straightforward: confirm Chrome is on 143.0.7499.192 or later and Edge on 150.0.4078.48 or later, and prune extensions that no longer earn their permissions.

Disclosure: NewUJ's editorial process uses Anthropic's Claude models.