BragJack: one extension targeting the AI agents of five browser products

Gal Weizman of Forever Security presented BragJack — a series of attacks on the AI features of Chrome Gemini Live, Perplexity Comet, Microsoft Edge Actions, Opera Neon, and Claude in Chrome using a Chromium extension.

The attacks build on a technique Weizman calls DiNneR Serving, which abuses declarativeNetRequest (DNR). A malicious extension can modify security-related HTTP headers and redirect JavaScript requests which, combined with product-specific flaws, can interfere with trusted AI interfaces.

In Chrome, DNR unexpectedly continued to work inside the gemini.google.com WebView embedded in the privileged chrome://glic. The researcher removed CSP restrictions, redirected JavaScript loading, and achieved JavaScript execution in the Gemini context, from which he could directly invoke GLIC capabilities. This provided access to websites, local files and directories via file://, PDFs and screenshots, and profile information. The research also showed that GLIC exposes camera and microphone capabilities that could potentially be invoked without a new permission prompt if Gemini had already been granted access.The vulnerability was assigned CVE-2026-0628. Unlike the other four cases, however, the author's results table does not classify the Chrome issue as a full browser-agent hijack.

In Comet, Edge, Opera Neon, and Claude in Chrome, the attacks enabled Prompt Forcing — directly passing an arbitrary instruction to the AI agent through an interface it already trusts. Unlike Prompt Injection, the attacker does not need to convince the model to follow instructions hidden inside untrusted content.

For example, in Comet, the researcher could invoke START_AGENT and instruct the agent to open email, collect messages, and send them to another address. Edge, Opera Neon, and Claude exposed comparable agent-control paths through their own integration flaws. After the extension was installed, the demonstrated chains required no additional user clicks, although the Edge and Claude exploits used the extension's debugger permission to synthesize a user click.

The research resulted in $20,500 in bug bounties and two CVEs: CVE-2026-0628 for Chrome and CVE-2026-55945 for Edge.

Article: https://forever.security/blog/bragjack-attack-hijacks-every-browser-agent