GoKawiilBragJack flaw let malicious extensions hijack AI browser agents in five browsers
Security researcher Gal Weizman of Forever Security found that a single malicious browser extension could take over AI assistants embedded in Chrome, Edge, Opera Neon, Perplexity Comet and Claude in Chrome, using Chromium's declarativeNetRequest feature to manipulate trusted network traffic without any user interaction. The technique, called BragJack, earned Weizman over $20,000 in bug bounties across the five vendors and generated two CVEs, with Google and Microsoft having already patched the issues.
GoKawiil's interpretation of the reporting above, not reported fact.
As browsers grant AI assistants deep privileges like reading tabs and acting on a user's behalf, any weakness in the trust boundary between extensions and these agents becomes a powerful attack vector, potentially letting attackers silently exfiltrate data or perform actions as the victim. This case shows that adding AI capabilities to browsers expands the attack surface in ways traditional extension security models weren't designed to handle.
- A single malicious extension could hijack AI agents in five major Chromium-based browsers without user interaction.
- The attack abused Chromium's declarativeNetRequest feature to manipulate network traffic trusted by privileged AI components.
- Google and Microsoft have patched the flaws, and the research earned over $20,000 in bounties and two CVEs.
Yubico YubiKey 5C NFC Security Key — With browser extensions now shown capable of hijacking AI assistants and browser-level privileges, locking down account access with hardware-based authentication is more important than ever. A YubiKey adds a physical layer of security that malicious extensions or hijacked AI agents can't bypass, protecting your most sensitive accounts even if your browser is compromised.”
See Yubico YubiKey 5C NFC Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: bleepingcomputer.com, 2026-09-19
Published there as: “BragJack attacks hijack AI browser agents through malicious extensions”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.