BragJack Shows the Risk of Malicious Browser AI Assistant Extensions
A researcher from Forever Security published proof-of-concept BragJack attacks. According to him, a malicious extension could abuse the integration of AI assistants in Chromium browsers.
BragJack attacks show how an already-installed malicious Chromium extension could abuse AI assistants integrated into the browser. The research was published by Gal Weizman of Forever Security. It describes proof-of-concept scenarios for Gemini Live in Chrome, Perplexity Comet, Microsoft Edge Actions, Opera Neon, and Claude in Chrome.
This is not a remote attack without user interaction. The basic requirement is that the user already has an untrusted extension installed with the necessary permissions. According to the author, an attacker could then abuse the AI agent’s capabilities to read sensitive data or perform actions on the user’s behalf.
BragJack attacks and extension permissions
The technical basis of the described method is the abuse of the declarativeNetRequest permission. It allows extensions to define rules for network requests. The researcher says he used it to modify responses and load the attacker’s code into trusted browser contexts.
These contexts are important because an AI assistant integrated directly into the browser may have broader capabilities than an ordinary website. The research therefore points to a situation in which privileges available to an AI feature could, through an improperly designed integration point, be transferred to malicious extension code.
Forever Security lists access to sensitive data and the performance of operations through the agent among the stated capabilities. However, the specific scope of potential impacts, such as access to files, screenshots, the camera, or the microphone, is based primarily on claims by the research author. The independent materials available do not independently confirm these scenarios.
CVEs for Chrome and Microsoft Edge
The research is associated with CVE-2026-0628 for Chrome and CVE-2026-55945 for Microsoft Edge. According to BleepingComputer, Google and Microsoft fixed the flaws assigned to them. The materials do not provide details about the specific versions that were fixed, so users should monitor security information and updates from their browser vendors.
A definitively confirmed patch status for Perplexity Comet, Opera Neon, and Claude in Chrome is not available in the independent materials. This does not mean the products have not been fixed, but the information provided cannot determine the status or scope of any fix.
Practical context for users
According to the described scenario, the risk primarily concerns people who use AI features in Chromium-based browsers and also install an untrusted extension with the necessary permissions. Merely visiting a website without installing an extension is not a prerequisite for a BragJack attack.
- Check the source of extensions before installing them.
- Pay attention to the permissions an extension requests.
- Remove add-ons you do not use or trust.
- Keep your browser updated.
At present, there is no confirmation that BragJack has been exploited in real-world attacks against users. The published materials describe proof-of-concept demonstrations. It will be important to monitor for any evidence of exploitation outside the research environment, confirmation of fixes in other affected products, and security recommendations from vendors regarding extension permissions and AI agents.
Sources
- Forever Security – BragJack: How We Hijacked 5 Of The World's Most Popular Browsers Using Their Built-In AI Assistants – Primary description of the research, affected products, the malicious-extension requirement, and the stated impacts.
- Forever Security – BragJack Technical Overview – Technical details of the declarativeNetRequest abuse, the listed CVEs, and the scope of the proof-of-concept demonstrations.
- BleepingComputer – BragJack attacks hijack AI browser agents through malicious extensions – Independent coverage of the research, including the claim that Google and Microsoft fixed the assigned flaws.
Verified and updated: 20. 09. 2026 15:25
