The security researcher Gal Weizman from Forever Security published an attack method called BragJack on September 16, 2026, which hijacks AI assistants in five popular browsers through a single malicious extension. Affected are Gemini in Chrome, Copilot in Edge, Opera Neon, Perplexity Comet, and Claude in Chrome. The extension uses only regular browser functions, so traditional antivirus scanners do not detect it.
Extension disguises itself as a harmless add-on
According to Forever Security, modern browser AI assistants separate a “brain” on the provider’s servers from a “body” in the browser that executes commands. BragJack targets this interface: an extension uses two standard functions that are already available to developers – content scripts that inject code into web pages, and Declarative Net Request (DNR), a technique for redirecting network requests. This lets the extension redirect communication between the browser and the AI service to its own code instead of executing malicious code itself.
Weizman calls his method “Prompt-Forcing” and distinguishes it from classic prompt injection: instead of just injecting individual instructions into content that the assistant reads anyway, the extension sends complete prompts itself and then sends further follow-up commands. The attack proceeds like a regular user request that the assistant dutifully carries out. Because no classic malicious code runs, and the assistant appears to perform legitimate tasks, traditional antivirus and endpoint programs do not respond.
Each browser falls for its own trick
Depending on the target, the research relied on different weaknesses:
- In Chrome, the extension abused DNR to load its own code instead of the real Gemini script, bypassing restrictions on content scripts at the network level (CVE-2026-0628).
- In Microsoft Edge, the extension also had to defeat a separation between Copilot’s “thinking” and “acting” modes, achieved through a race condition during the mode switch (CVE-2026-55945).
- In Opera Neon, according to Weizman, the simplest route sufficed: the domain opera.com had no extension restrictions at all, letting code be injected directly into the AI’s control layer.
- For Claude in Chrome, a marketing page from Anthropic allowed sending special prompts; the extension injected code directly into this domain.
- For Perplexity Comet, the team found an abandoned test domain that still accepted commands for the assistant – the most elaborate but effective of the five routes.
Depending on the browser, the attackers could read local files, activate the microphone and camera, capture browsing history and profile data, take screenshots, or automatically summarize and forward emails, according to Forever Security.
Vendors pay bounties, details remain open
Google, Perplexity, Microsoft, Opera, and Anthropic confirmed the reports with bounties ranging from $600 to $7,000, totaling around $20,400. None of the vendors has published a detailed confirmation of which vulnerabilities are fully closed – so the patch status is not independently verified. It is already the second such series of findings within a few weeks: in August, security firm Zenity used PleaseFix to show how the same five assistants can be remotely controlled via a crafted email or calendar invitation, with no user click required. Claude’s Chrome integration, which Anthropic expanded in August with automatic confirmation steps, is also among the systems affected again.
With BragJack, Weizman has already published his second investigation into Chrome agents: an earlier vulnerability called GlicJack affected only Google’s Gemini integration. Forever Security reported all five cases to the respective vendors before publication and treated the paid bounties as confirmation of its findings.
What matters now is whether the vendors change the underlying architecture that grants browser extensions blanket access to the communication between the AI “body” and AI “brain.” Weizman’s team has already said it plans to examine the next generation of browser agents for the same weakness – as long as open test domains and unprotected marketing pages serve as entry points, this is unlikely to be the last vulnerability of its kind.
