One rogue extension was able to hijack the AI assistant inside five different browsers

Security researcher Gal Weizman of Forever Security has demonstrated that a single malicious browser extension can hijack the AI assistant built into five different browsers: Google Chrome’s Gemini Live, Perplexity Comet, Microsoft Edge, Opera Neon and Anthropic’s Claude in Chrome. Weizman calls the technique BragJack, and once the extension is installed and active, the takeover he demonstrates runs without any further action from the person using the browser. The disclosure earned Weizman more than $20,000 in bug bounties from the five vendors, with individual payouts ranging from $600 to $7,000, and produced two tracked CVEs.

A single extension, five hijacked AI agents

The attack requires the malicious extension to already be installed in the victim’s browser; from that starting point, Weizman shows the takeover runs without further user interaction. An extension can then control an AI browser agent and abuse whatever privileges that agent already holds to reach sensitive information or take action, according to the research. Google and Microsoft have each resolved the flaw assigned to their product; Weizman’s public writeup does not say whether Perplexity, Opera or Anthropic have shipped fixes for the issues found in Comet, Neon and Claude in Chrome.

In his writeup, Weizman describes these AI-browser systems as having a “brain” and a “body”: the AI model processes instructions and decides what should happen, while a privileged browser component carries out the action, such as opening tabs, reading page content or taking screenshots. The vulnerability, he argues, is that ordinary browser extensions can already manipulate the web traffic and pages that those privileged components are built to trust.

Chrome’s Gemini Live and the declarativeNetRequest trick

All five demonstrations relied on the same extension mechanism: Chromium’s declarativeNetRequest application programming interface, which lets an extension rewrite how the browser handles network requests, including altering response headers and redirecting resources. In Chrome, Weizman found that extensions were already blocked from touching the privileged chrome://glic component directly or injecting scripts into Google’s Gemini site. Declarative network request rules could still intercept requests made by the embedded Gemini web app, weakening security headers and redirecting a JavaScript resource so Weizman’s code ran inside the Gemini context and communicated directly with Chrome’s privileged AI component.

Weizman says that access could read local files, reach web content, take screenshots and potentially reach a device’s camera and microphone through the same privileged path Chrome grants its own AI component. Chrome assigned the finding CVE-2026-0628 and paid a $7,000 bounty, the largest of the five payouts described in the research, before shipping a fix.

Comet and Edge: from reading data to acting on the agent’s behalf

The attacks against agentic browsers go further because those agents can act on websites rather than only read them. In Perplexity Comet, Weizman found the browser’s built-in agent extension trusted several Perplexity domains, including a testing domain that did not receive the same protections as the primary perplexity.ai site. Removing a redirect to that domain with a declarative network request rule let him load it and inject a content script able to communicate with the built-in agent, gaining access to browsing history, screenshots, local files and the ability to send the agent instructions directly.

Weizman demonstrated forcing the Comet agent to visit Perplexity, summarize the victim’s emails, and send the results to another address, without further input from the person using the browser. Microsoft Edge posed a different problem: Microsoft had already split its agent into separate “Think” and “Do” modes specifically to stop it from receiving instructions and carrying out actions at the same time. Weizman found a race condition that briefly disables that restriction while a prompt is being forced, then re-enables the agent’s ability to act before it checks its own state again, a flaw Microsoft assigned CVE-2026-55945.

Bounties, CVEs and what Prompt Forcing means for defenders

Weizman calls the underlying technique Prompt Forcing. Unlike conventional prompt injection, where an attacker tries to slip malicious instructions into content an AI model is already reading, Prompt Forcing hands the agent an entire prompt and a set of follow-up instructions directly. The agent then translates those instructions into legitimate browser actions using privileges it already holds, rather than executing any code that a traditional security scanner would recognize as foreign to the browser.

Endpoint security tools built to catch malicious code face a specific problem here: the final action in a BragJack attack comes from legitimate, already-trusted software doing exactly what a privileged AI agent is designed to do, under instructions the agent did not actually receive from its own user, rather than from any file or script a scanner would flag as out of place in the browser. Weizman’s disclosures against Opera Neon and Claude in Chrome followed a similar pattern to the Comet and Edge cases, though Claude in Chrome is itself a browser extension rather than a full browser.

Weizman’s advice for now is narrow: keep browsers updated, remove extensions that are not recognized or no longer in use, and treat any extension asking for broad permission to read and change data on every website with real suspicion. Five vendors, two CVEs and more than $20,000 in bounties later, the design tension Weizman describes between an AI agent’s existing privileges and the extensions already sitting inside the same browser remains unresolved, and BragJack is unlikely to be the last proof of concept built around it.

More from Morning Overview

This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.