One Browser Extension Can Hijack Your AI Assistant: BragJack Explained

Watch the 2-minute video:

You installed a free ad blocker. It has good reviews and a lot of users, so it looks harmless. But your browser now has an AI assistant built in, one that can read pages, open your email and act for you. That changes what a bad extension can do.

In September 2026, researcher Gal Weizman (Forever Security) published BragJack. One extension, with small tweaks per browser, took over the built-in AI agents of five products:

Gemini in Google Chrome
Copilot in Microsoft Edge
Perplexity Comet
Opera Neon
Claude in Chrome

How BragJack works

Most AI attacks you hear about are prompt injection: hidden text on a web page that tries to confuse the model. BragJack is different. The researcher calls it prompt forcing: it doesn’t trick the AI at all.

Browser AI assistants have two halves: the “brain” runs on the vendor’s website, and a privileged “body” inside the browser carries out actions. The body trusts instructions that come from certain vendor pages. So the extension goes after those pages:

The victim installs the extension. This is the one step that needs the user.
The extension uses declarativeNetRequest, a permission ad blockers use every day that shows no scary warning, to intercept a script that a trusted AI page loads and swap it for its own code.
That code now runs inside a page the assistant trusts, so it can send the assistant its own orders, with follow-ups, as if they came from the browser vendor.
The assistant obeys. The researcher showed it reading local files, taking screenshots, turning on the camera and microphone, reading browsing history, acting on logged-in sites, and reading and sending out email.

Each browser fell a little differently. In Chrome a script inside Gemini’s privileged view was swapped. In Comet a leftover testing.perplexity.com domain was still trusted. In Edge a Microsoft marketing page could talk to Copilot, combined with a race between its “Think” and “Do” modes. In Opera Neon code on opera.com could send prompts. In Claude in Chrome a marketing page could send prompts to the side panel.

Because there’s no malware file, just plain-English instructions, the researcher points out that EDR tools aren’t built to catch it.

The good news

No attacks in the wild have been reported, and neither CVE was in CISA’s Known Exploited list when the research came out.
Chrome fixed it as CVE-2026-0628 (rated 8.8) in 143.0.7499.192/.193.
Edge fixed it as CVE-2026-55945 (medium) in 150.0.4078.48 (July 2, 2026).
Perplexity, Opera and Anthropic paid bounties too (about $20,000 in total across all five), but their patch status wasn’t publicly confirmed in the coverage. Keep those apps updated.

The bigger lesson: patching one bug doesn’t change the design. Any extension you install sits right next to an AI that can act for you.

Step 1: Update your browser

Chrome: type chrome://settings/help in the address bar, wait for the update, click Relaunch.
Edge: type edge://settings/help, then Restart.
Comet, Opera Neon, Claude in Chrome: install every update the vendor offers.

The update isn’t installed until you relaunch. A browser left open for weeks is still running the old version.

Step 2: Clean your extensions

Open chrome://extensions or edge://extensions and go through the list:

Remove anything you don’t use or don’t recognize. Fewer extensions means less to attack.
Be extra careful with extensions that can “Read and change all your data on all websites”. For the ones you keep, open Details > Site access and choose On click or On specific sites.
Free tools with huge user counts are what attackers buy and turn malicious later, so a good review score isn’t proof.

Step 3: Make your AI ask first

In your browser AI agent’s settings, turn off any “act without asking” or auto-run option, so it asks before each action. In Claude in Chrome the setting is literally called “Act without asking”.
If you never use the browser’s AI agent, switch it off. A feature you don’t use can’t be hijacked.

For admins: lock it down for everyone

Use browser policy to allow only the extensions you approve, and block the two permissions BragJack relied on. Chrome example:

{
  "ExtensionInstallBlocklist": ["*"],
  "ExtensionInstallAllowlist": ["<approved-extension-id-1>", "<approved-extension-id-2>"],
  "ExtensionSettings": {
    "*": {
      "blocked_permissions": ["declarativeNetRequest", "debugger"]
    }
  }
}

Windows GPO: with the Chrome or Edge ADMX templates, go to Extensions and set the installation blocklist to *, the allow list to your approved IDs, and extension management settings to the JSON above. Edge uses the same policy names. In Intune, use the Settings catalog for Microsoft Edge or Google Chrome.
Test before you roll it out. Blocking declarativeNetRequest also blocks most ad blockers. If you need one, allow it by ID with its own ExtensionSettings entry.
Check the result in chrome://policy or edge://policy.
Treat AI-agent activity as its own log source. Watch for browser-driven access to files, cameras, microphones and email.

Checklist

[ ] Chrome is 143.0.7499.192 or later, Edge is 150.0.4078.48 or later, and both have been relaunched
[ ] Unknown and unused extensions are removed
[ ] The extensions you keep have site access set to “On click” where possible
[ ] The AI agent asks before acting (“act without asking” is off)
[ ] The browser AI agent is off if nobody uses it
[ ] Admins: extension allowlist + blocked_permissions policy tested and deployed

Sources

Cyber Security News, “BragJack Attack Lets Malicious Extensions Hijack AI Agents Across 5 Major Browsers” (Sep 19, 2026): https://cybersecuritynews.com/bragjack-ai-agent-hijacking/
Tech Times, “Single Extension Hijacks AI Agents in Five Browsers Without Any User Clicks” (Sep 20, 2026): https://www.techtimes.com/articles/327778/20260920/single-extension-hijacks-ai-agents-five-browsers-without-any-user-clicks.htm
Cyber Press, “BragJack Attack Lets Browser Extensions Hijack AI Agents Across Chrome, Edge and Comet” (Sep 21, 2026): https://cyberpress.org/bragjack-attack-lets-browser-extensions-hijack-ai-agents/
Adversa AI, AI agent security incidents roundup (Oct 2026): https://adversa.ai/blog/top-ai-agent-security-resources-october-2026/
Extension Auditor, browser extension security policy guide: https://extensionauditor.com/blog/browser-extension-security-policy-enterprise-guide

Watch the video:

Take away support: IT fixes, delivered in under two minutes. By Abd Almouhimen Shamout, mouhimen.dev