← Back to articles

BragJack attacks hijack AI browser agents through malicious extensions

2026-09-19 | original

read original get Yubico YubiKey 5C NFC Security Key → more articles

Why This Matters

This disclosure highlights a serious security gap in how AI assistants are being deeply integrated into mainstream browsers, showing that a single malicious extension can hijack an AI agent's privileged capabilities to silently access sensitive data or perform actions without user consent. As browser makers race to embed AI 'agents' with broad system access, this research underscores that the security models governing extensions and AI components haven't kept pace with these new trust boundaries. It's a wake-up call for both vendors and users about the risks of granting AI assistants deep browser-level privileges.

Key Takeaways

A researcher demonstrated BragJack, an attack using a single malicious extension to hijack AI assistants in five major Chromium-based browsers, earning over $20,000 in bug bounties.
The attack exploits Chromium's declarativeNetRequest feature, letting extensions manipulate network traffic trusted by privileged AI components to seize control without user interaction.
Google and Microsoft have patched the flaws, but the research reveals a broader architectural risk as browsers increasingly grant AI agents privileged, trusted access to sensitive functions.

Worth a Look

Yubico YubiKey 5C NFC Security Key — With browser extensions now shown capable of hijacking AI assistants and browser-level privileges, locking down account access with hardware-based authentication is more important than ever. A YubiKey adds a physical layer of security that malicious extensions or hijacked AI agents can't bypass, protecting your most sensitive accounts even if your browser is compromised.”

See Yubico YubiKey 5C NFC Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.

Security researcher Gal Weizman of Forever Security has disclosed a new attack technique that can hijack the AI assistants built into popular browsers using a single malicious browser extension.

Dubbed BragJack, the proof-of-concept was demonstrated against five Chromium-based browsers or browser assistants: Google Chrome's Gemini Live, Perplexity Comet, Microsoft Edge, Opera Neon, and Anthropic's Claude in Chrome.

The research earned more than $20,000 in bug bounties from the five vendors, ranging from $600 to $7,000, and produced two CVEs.

The attack requires the malicious extension to already be installed in the victim's browser.

Once it is, the researcher shows the abuse can run without user interaction, letting an extension control an AI browser agent and abuse its existing privileges to access sensitive information or act on the victim's behalf.

Both Google and Microsoft have since resolved the flaws they were assigned.

Abusing trusted browser components

The attacks exploit the way AI assistants are increasingly wired into browsers and handed browser-level capabilities.

In his writeup, Weizman describes these systems as having a "brain" and a "body." The AI model processes instructions and decides what should happen.

A privileged browser component then performs the actions, such as accessing tabs, reading content, taking screenshots, or interacting with websites.

... continue reading

Explore topics: bragjack gal weizman gemini live perplexity comet claude in chrome