Security researchers are increasingly warning that the rapid integration of artificial intelligence into everyday software is creating complex new attack surfaces. A striking example of this evolution has recently come to light through the work of independent security researcher Gal Weizman of Forever Security, who has successfully disclosed and demonstrated a novel attack technique called BragJack. This methodology allows a single, pre-installed malicious browser extension to completely hijack the native AI assistants embedded within prominent Chromium-based browsers and web applications. The implications of this research extend far beyond simple data exfiltration, highlighting fundamental security challenges in how modern web browsers partition privileges between extensions and deeply integrated generative AI frameworks.
The scope of the BragJack proof-of-concept is extensive, targeting five distinct browser-based AI implementations: Google Chrome’s Gemini Live, Perplexity Comet, Microsoft Edge, Opera Neon, and Anthropic’s Claude in Chrome extension. By exploiting systemic architectural oversights, Weizman was able to demonstrate that an attacker could completely subvert these AI engines without requiring any real-time user interaction once the malicious extension was planted. This capability grants rogue actors unauthorized access to sensitive local files, browsing histories, private communications, and the ability to autonomously execute commands on behalf of the victim. In recognition of the severity of these findings, major technology vendors have awarded Weizman more than $20,000 in bug bounties—with individual payouts ranging from $600 to $7,000—and issued multiple critical CVE identifiers to track and patch the underlying vulnerabilities.
The Architecture of Trust: Understanding the Brain and Body Paradigm
To fully comprehend how BragJack operates, security analysts must examine the modern architectural design of AI-powered browsers. Historically, web browsers functioned as secure sandboxes where extensions operated under tightly monitored constraints, interacting with web pages through well-defined APIs. However, the introduction of generative artificial intelligence has fundamentally altered this paradigm. Browsers no longer merely render web pages; they now interpret intent, summarize content, and take autonomous actions.
In his technical documentation, Weizman conceptualizes these advanced browser assistants as having a distinct "brain" and "body." The brain consists of the underlying large language model (LLM), which processes unstructured human instructions and formulates a plan of action. The body, conversely, comprises privileged browser components and system-level application programming interfaces (APIs) that possess the raw capability to execute those plans. These components can read arbitrary local files, capture high-resolution screenshots, navigate across restricted web domains, manipulate active DOM elements, and access hardware peripherals such as webcams and microphones.
The core vulnerability exploited by BragJack lies in the fact that legacy extension security models were never designed to anticipate an attacker weaponizing a browser extension to manipulate the network traffic and internal resources that these privileged AI components blindly trust. By injecting subtle modifications into communication pipelines, malicious extensions can bypass the conceptual barrier between standard web content and elite system-level AI workflows.
Anatomy of the Exploits: From Chrome to Edge and Beyond
The execution vectors utilized in the BragJack research varied significantly depending on the architectural defenses of each targeted platform. Across all vectors, however, the researcher relied on Chromium’s native declarativeNetRequest (DNR) API. While DNR was originally designed to help privacy and ad-blocking extensions efficiently manage network traffic without inspecting every single web request, Weizman weaponized it to manipulate network headers and redirect internal JavaScript resources.
In the case of Google Chrome, the browser’s internal architecture strictly blocks extensions from directly interacting with the privileged chrome://glic component or injecting unauthorized scripts directly into Google’s core Gemini domains. Despite these safeguards, Weizman discovered that DNR rules could successfully intercept network requests generated by the embedded Gemini web application itself. By strategically weakening security headers and intercepting a vital JavaScript resource, the malicious extension executed code directly within the Gemini security context. This established a direct, trusted communication channel with Chrome’s privileged AI backend, completely bypassing the standard validation flows. Google acknowledged this flaw, assigned it CVE-2026-0628, and rewarded the researcher with a $7,000 bounty before rolling out a comprehensive desktop patch in the stable channel update.
The attack vectors against agentic browsers—such as Perplexity Comet and Opera Neon—demonstrated an even greater capacity for harm because these assistants are explicitly designed to act upon the web rather than merely passive document reading. For Perplexity Comet, the browser’s internal agent trusted several associated domains, including a legacy testing domain that lacked the robust security hardening applied to the primary production site. By utilizing DNR rules to remove a standard redirect, Weizman forced the browser to load this less-protected domain, injected a custom content script, and established a direct dialogue with the built-in assistant. The resulting compromise granted access to localized browsing histories, local files, live screenshots, and the ability to feed synthetic instructions directly to the agent. During demonstrations, Weizman successfully compelled the browser agent to navigate to Perplexity, automatically synthesize and summarize the victim’s private emails, and exfiltrate the resulting data to an external address controlled by the attacker.
Microsoft Edge presented a unique engineering hurdle due to safety features implemented by Microsoft developers. Specifically, Microsoft had deliberately split its AI agent into distinct "Think" and "Do" modes. This segregation was implemented precisely to prevent the model from simultaneously processing arbitrary, untrusted instructions and executing high-privilege system actions. However, Weizman uncovered a critical race condition within the state-management logic. By flooding the application with rapid requests, an attacker could briefly disable the operational restriction while simultaneously forcing a malicious prompt, successfully tricking the agent into executing unauthorized commands before the security state could re-verify itself. Microsoft cataloged this race condition under CVE-2026-55945.
Similar methodology and vulnerabilities were successfully replicated against Opera Neon and the popular Claude in Chrome extension. The findings regarding the Claude extension build upon a growing body of security research. Earlier in the year, security analyses by Manifold Security revealed that the Claude for Chrome extension processed workflows driven by synthetic click events without adequately verifying whether those inputs originated from a genuine human user. That discovery followed the disclosure of ClaudeBleed—another high-profile flaw identified by LayerX—wherein the extension mistakenly trusted the broad claude.ai origin rather than meticulously verifying which specific internal script was driving the transaction.
Prompt Forcing: A New Class of Cyber Threat
One of the most significant conceptual contributions of Weizman’s research is the formalization and naming of a distinct attack vector he terms "Prompt Forcing." To understand the danger of Prompt Forcing, security professionals must contrast it with traditional prompt injection attacks.
In a conventional prompt injection scenario, an adversary hides malicious instructions inside passive content—such as a seemingly innocuous webpage, a PDF document, or an incoming email—in the hope that an AI assistant will read the text and accidentally follow the hidden commands. While dangerous, traditional prompt injection is often bounded by the security context of the specific document or website the AI is currently viewing.
Prompt Forcing, by contrast, fundamentally flips the dynamic. Instead of hoping the AI reads a contaminated document, the attacker’s malicious browser extension directly injects an entirely fabricated prompt and an extensive sequence of chained follow-up instructions straight into the AI agent’s internal input pipeline. Because the prompt originates from what the browser perceives as a legitimate administrative or local extension context, the AI assistant readily accepts the instructions as valid user intent. The model then translates those malicious instructions into authorized browser operations, leveraging its pre-existing high-level privileges to compromise the machine.
This distinction creates an unprecedented hurdle for traditional endpoint detection and response (EDR) software. Because the final malicious actions—such as reading local directories, fetching personal documents, or transmitting browser session data—are physically carried out by legitimate, trusted browser processes acting under the direct orders of their integrated AI assistants, behavioral security tools frequently fail to flag the activity as anomalous. The software is not technically being hacked; rather, legitimate software is being systematically weaponized against its user.
Industry Response, Remediation, and Mitigation Strategies
In the wake of these disclosures, major software vendors have rushed to close the security gaps exposed by the BragJack research. Google and Microsoft have both deployed critical security patches addressing the specific CVEs assigned to their respective browser environments. Perplexity, Opera, and Anthropic have likewise initiated internal code reviews to harden their extension validation checks and reinforce the isolation barriers between third-party extension APIs and internal agent communication channels.
Nevertheless, security analysts emphasize that patching individual vulnerabilities will not suffice to solve the broader structural risk. As web browsers evolve from simple document viewers into autonomous operating environments driven by generative artificial intelligence, the attack surface will inevitably expand. The integration of high-privilege "do" capabilities alongside intelligent "think" engines requires an entirely new philosophy of browser security architecture—one that assumes extensions may be malicious and implements zero-trust boundaries even between internal browser components.
For everyday end-users and enterprise environments alike, the BragJack research serves as a stark reminder of the hidden risks lurking within modern browser extensions. Cybersecurity experts recommend several foundational best practices to mitigate these evolving threats:
- Maintain Rigorous Software Hygiene: Users should ensure that their web browsers and all associated security patches are updated to the absolute latest versions immediately upon release.
- Audit Browser Extensions: Individuals and enterprise IT administrators must regularly review installed extensions, promptly removing any add-ons that are unrecognized, outdated, or no longer actively utilized.
- Exercise Extreme Caution with Permissions: Browser extension permission prompts—particularly those requesting broad, sweeping authorities such as the ability to "read and change all your data on all websites"—should be scrutinized heavily before installation. In many cases, these expansive permissions provide the precise footholds required for advanced exploitation chains like BragJack.
As artificial intelligence continues to redefine the boundaries of human-computer interaction, the security community faces an uphill battle in ensuring that the tools designed to make our digital lives easier do not simultaneously become the most efficient vehicles for our compromise. Detailed technical breakdowns and comprehensive documentation of the BragJack methodology have been published by Forever Security to assist developers and security researchers in fortifying the next generation of intelligent software.
