The research earned more than $20,000 in bug bounties from five vendors and produced two CVEs, but the vulnerability it exposes is less about cash than control: a single malicious extension can hand an AI-powered browser agent a ready-made set of instructions and let it act with the browser’s existing privileges.
BragJack and Gal Weizman’s proof-of-concept
Security researcher Gal Weizman of Forever Security disclosed a proof-of-concept he calls "BragJack" that hijacks AI assistants embedded in Chromium-based browsers using one malicious extension already installed in the victim’s browser. Weizman demonstrated the technique against five targets: Google Chrome's Gemini Live, Perplexity Comet, Microsoft Edge, Opera Neon, and Anthropic’s Claude when run as a Chrome extension. The work earned bounties from the five vendors (ranging from $600 to $7,000) and produced two assigned CVE identifiers.
How the attack leverages the browser “brain” and “body”
Weizman describes modern browser agents as having a "brain" and a "body": the AI model (brain) decides what should happen, while a privileged browser component (body) performs actions such as reading tabs, taking screenshots, or interacting with web pages. BragJack abuses the trust boundary between those parts by having an already-installed extension manipulate requests and content that the privileged component trusts, then hand the agent a full prompt plus follow-up instructions.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildTechnical vectors: Chromium DNR, Prompt Forcing, and a race condition
- DeclarativeNetRequest (DNR): The same malicious extension worked across all five targets by relying on Chromium’s DNR functionality. DNR lets extensions change how network requests are handled — for example, by altering response headers or redirecting resources. In Chrome’s case, Weizman used DNR to weaken security headers and redirect a JavaScript resource, executing code inside the embedded Gemini web app context and communicating directly with Chrome’s privileged AI component.
- Prompt Forcing: Weizman names the class of abuse "Prompt Forcing." Unlike prompt injection, which slips instructions into content the AI is already reading, Prompt Forcing hands the agent an entire prompt and follow-up steps so the agent translates those instructions into legitimate browser actions using its existing privileges. The researcher argues this shifts the attack surface: a legitimate component performs the final malicious action.
- Race condition in Edge: Microsoft’s Edge implemented a split between "Think" and "Do" modes to restrict simultaneous instruction and action. Weizman found a race condition that momentarily disables that restriction while forcing a prompt, then re-enables action capability before the agent checks its state; Microsoft assigned CVE-2026-55945 to that finding.
Concrete examples: Gemini, Comet, Opera Neon, and Claude
The demonstrations differ by product because of how each agent is integrated.
- Google Chrome / Gemini Live: Although extensions were blocked from directly modifying chrome://glic or injecting scripts into Gemini’s site, DNR interception of requests to the embedded Gemini web app allowed redirection of scripts and code execution within Gemini’s context. Chrome assigned CVE-2026-0628 and paid a $7,000 bounty.
- Perplexity Comet: Comet’s built-in agent extension trusted several Perplexity domains, including a testing domain lacking the protections of the main site. By removing a redirect to that testing domain via DNR, Weizman injected a content script that could talk to the agent. He demonstrated access to browsing history, screenshots, local files, and the ability to send instructions to the agent — including forcing it to visit Perplexity, summarize the victim’s emails, and send the results to another address.
- Opera Neon and Anthropic’s Claude for Chrome: Similar classes of weakness were shown against Opera Neon and Claude in Chrome. The article also notes earlier related findings in Claude for Chrome reported by the author’s prior work at Manifold Security and a prior "ClaudeBleed" disclosure by LayerX in April.
Vendor fixes, CVEs, and the practical takeaway
Vendors rewarded the researcher across five vendors with bounties totaling more than $20,000 (individual payments ranged from $600 to $7,000) and two CVEs were produced: CVE-2026-0628 (Chrome) and CVE-2026-55945 (Microsoft Edge). Both Google and Microsoft have resolved the flaws they were assigned, according to the disclosure. The disclosures show a pattern: as browsers grant AI agents more browser-level capabilities, traditional extension privileges become a more powerful and surprising attack surface.
What this means for technologists, affected enterprises, and end users
- Technologists and security teams: Endpoint defenses must account for attacks carried out by legitimate, privileged components after they’re given instructions — not only for conventional malicious code. The researcher frames Prompt Forcing as a concern for defenders because the final action is performed by trusted software.
- Affected enterprises and procurement leaders: Products that embed agents with browser-level capabilities should be evaluated for how they validate origins, protect testing domains, and separate read and act privileges; the Perplexity example shows a testing domain with weaker protections can be an exploitable vector.
- End users and the general public: The researcher’s immediate advice is practical: keep browsers fully updated, remove extensions you do not recognize or no longer use, and treat broad "read and change all your data on all websites" permission prompts with caution.
BragJack reframes a familiar problem: when the browser’s own assistant can perform powerful actions, a compromised extension is no longer just a snoop on web pages but a potential conductor of the browser itself. The public writeup and the full technical breakdown published by Weizman leave a clear path for defenders — and a reminder that as agents gain agency, trust boundaries deserve re-examination.
Original reporting: BleepingComputer — BragJack attacks hijack AI browser agents through malicious extensions
