BragJack Uses Malicious Extensions to Hijack Browser AI Agents

Summary

Researcher Gal Weizman demonstrated BragJack attacks against five browser AI assistants, using malicious extensions to access sensitive data or direct agents to act for users. Google and Microsoft fixed their assigned flaws.

Key points

BragJack requires a malicious browser extension to be installed, but the demonstrated attacks could run without further user interaction.
The technique abused Chromium’s declarativeNetRequest feature to alter trusted browser traffic and inject code.
Demonstrations targeted Chrome’s Gemini Live, Perplexity Comet, Microsoft Edge, Opera Neon, and Claude in Chrome.
The reported capabilities included accessing browsing history, local files and screenshots, and directing agents to take actions on websites.
For Edge, Weizman reported a race condition involving the agent’s Think and Do modes; Microsoft assigned it CVE-2026-55945.
Google assigned CVE-2026-0628 to its finding. Google and Microsoft have fixed the flaws assigned to them.
Weizman received more than $20,000 in bug bounties. The article advises removing untrusted extensions and keeping browsers updated.

Article Details

Attack Vectors: A malicious browser extension already installed on the victim's browser abuses Chromium's declarativeNetRequest functionality to intercept or redirect trusted requests and inject code into AI assistant contexts.
Injected code communicates with privileged browser AI components or built-in agents, enabling access to sensitive data and, in some cases, instructions that make the agent act on the victim's behalf.
In Microsoft Edge, the researcher reported exploiting a race condition that briefly disables an agent restriction while a prompt is forced.
Defensive Notes: Keep browsers fully updated; the article says Google and Microsoft resolved their assigned flaws.
Remove extensions that are unrecognized or no longer used.
Treat extension permissions to read and change data on all websites with caution.