--- url: "https://www.xcademia.com/news/bragjack-attack-one-browser-extension-hijacked-5-ai-powered-browsers" title: "BragJack Attack: One Browser Extension Hijacked 5 AI-Powered Browsers" description: "BragJack research reveals how one browser extension hijacked AI agents in Chrome, Edge, Opera, Comet and Claude, exposing new endpoint security risks." publishedAt: "2026-09-17T11:27:15.635+00:00" updatedAt: "2026-09-17T12:31:22.81731+00:00" type: news category: cybersecurity source_name: Forever Security source_url: "https://forever.security/blog/bragjack-hijacking-5-browsers-via-built-in-ai-assistants" tags: - "#BragJack" - "#BrowserSecurity" - "#AISecurity" - "#AgenticAI" - "#Cybersecurity" - "#EndpointSecurity" - "#BrowserExtensions" - "#AIThreats" --- # BragJack Attack: One Browser Extension Hijacked 5 AI-Powered Browsers > A new security research campaign called BragJack shows how one browser extension could hijack AI assistants in Chrome, Edge, Opera Neon, Perplexity Comet and Claude in Chrome. Source: **Forever Security** · 17 September 2026 ## BragJack Exposes a New Security Risk in AI-Powered Browsers Browser-based AI assistants are increasingly moving beyond simple chat interfaces. They can read webpages, interact with browser content and, in some cases, perform actions on behalf of users. A new security research project from Forever Security has demonstrated how this added capability can introduce a different class of endpoint security risk. Published on September 16, 2026, the research, called **BragJack**, describes vulnerabilities affecting five AI-powered browser environments: **Google Chrome with Gemini Live, Microsoft Edge, Opera Neon, Perplexity Comet and Claude in Chrome**. According to Forever Security, the researchers used a single browser extension to demonstrate attacks against all five environments. The research reports impacts ranging from browser-agent hijacking to access to local files, screenshots, browser information and, in the Chrome case, camera and microphone capabilities. The researchers also reported that the attacks could be performed with **zero user clicks** in the tested scenarios. The research resulted in vulnerability disclosures, two assigned CVEs, and bounty payments from the affected companies. ## What Is the BragJack Attack? The central issue identified by Forever Security is the relationship between an AI assistant and the software environment that executes its instructions. Traditional browser assistants generally provide information to a user. Agentic browser systems can go further. They may be able to interact with webpages, access browser data or perform actions. Forever Security describes this architecture using a simple analogy: - **The AI is the brain:** It interprets instructions and decides what actions should be taken. - **The browser is the body:** It has access to webpages, browser data and other capabilities needed to execute those instructions. - **The communication channel connects them:** The browser sends information to the AI service, while the AI returns instructions that the browser can execute. This creates a security boundary that is different from conventional web applications. If an attacker can interfere with the trusted communication path between the AI "brain" and the browser "body", the AI can potentially be manipulated into performing actions that the attacker controls. ![agent-works](https://0a515t3ure77wbvx.public.blob.vercel-storage.com/articles/1789643923668-agent-works.webp) ## Chrome: Gemini's AI "Brain" Meets a Powerful Browser "Body" The Chrome portion of the research started with Gemini Live. Forever Security describes the Chrome implementation as having an AI component hosted remotely and a browser component capable of executing actions locally. The researchers investigated whether an extension could influence the communication between these components. They reported that a network modification technique allowed them to replace a JavaScript resource associated with the Gemini environment. The resulting access, according to the researchers, could be used to: - Read local files - Access webpages - Capture screenshots - Access browser profile information - Trigger camera and microphone capabilities The technical overview provides additional details about the reported local file and browser profile access. The research emphasizes an important security principle: **protecting the AI website itself is not necessarily enough when another component can modify the traffic or resources used to communicate with the AI agent.** ## Opera Neon: Direct Control of the Browser Agent The researchers next examined **Opera Neon**, an AI-focused browser. Forever Security reported that Neon used a trusted Opera domain as a source of instructions for its browser AI agent. Unlike the Chrome configuration tested by the researchers, the researchers said Opera's domain did not prevent their extension from injecting code. That created a direct path to sending commands to the browser agent. The research demonstrated scenarios in which the agent could be instructed to interact with email and summarize information. The researchers also used network modification capabilities to make their activity less visible during testing. The Opera finding received a **$900 bounty**, according to Forever Security. ## Prompt-Forcing: A Different Kind of AI Attack One of the most important concepts introduced in the BragJack research is what Forever Security calls **Prompt-Forcing**. The researchers distinguish it from traditional prompt injection. In a typical prompt injection scenario, an attacker tries to insert malicious instructions into an existing AI interaction. According to Forever Security, the BragJack attacks instead allowed the researchers to control the entire prompt sent to the browser agent and then issue additional prompts. The research argues that this changes the security model because an attacker can potentially construct a sequence of instructions instead of relying on a single malicious input. The distinction is important for security teams because the malicious behavior may not look like conventional malware. The AI agent may simply be performing legitimate actions using legitimate software capabilities. ## Microsoft Edge: Two Vulnerabilities and a Race Condition Microsoft Edge presented a different challenge. According to Forever Security, Microsoft had implemented protections designed to prevent the extension-based technique used against other browsers. The researchers instead investigated an Edge marketing page associated with the browser's AI functionality. They reported that this page had a special capability allowing it to send prompts to the AI assistant. The research then identified two separate problems. First, the researchers found a way around a network-level protection affecting the page. Second, Edge's AI agent separated functionality into two modes: - **Think:** The agent could accept prompts and read pages. - **Do:** The agent could perform actions but was not intended to receive prompts. The researchers reported that switching between these modes at the right time allowed a prompt to be executed despite the intended separation. Forever Security described this as a **race condition**. The technical overview says Microsoft assigned **CVE-2026-55945** to the issue and awarded rewards for two vulnerabilities, including the race condition. The research reports a total of **$5,000 in bounty payments** associated with the Edge findings in its main comparison table. ![safety-boundary](https://0a515t3ure77wbvx.public.blob.vercel-storage.com/articles/1789644238705-safety-boundary.webp) ## Claude in Chrome: Extension-on-Extension Risk The researchers also examined **Claude in Chrome**. Although Claude in Chrome is an extension rather than a standalone browser, Forever Security treated it as a distinct browser-like environment because of how it provides agentic browser capabilities. The researchers identified a marketing page under the Claude domain that could send prompts to the AI side panel. According to the report, the page accepted arbitrary prompts rather than restricting requests to the limited prompts required for its intended functionality. Because other browser extensions could interact with the page, Forever Security reported that its test extension could use this mechanism to send instructions to the Claude assistant. The researchers demonstrated scenarios involving email information. Anthropic classified the finding as **medium severity**, according to the research, and Forever Security reported a **$600 bounty** in its main comparison table. The technical overview reports a $500 reward for the specific finding described there, highlighting that bounty figures can vary by the individual issue or reporting stage. ## Perplexity Comet: The Most Extensive Impact Reported The most extensive impact described in the research involved **Perplexity Comet**. Comet differs from traditional browsers because its browser experience is deeply integrated with an AI agent. Forever Security says the agent was designed to receive instructions from a trusted Perplexity domain and had access to browser capabilities. The researchers found a second address in the implementation, identified as a testing domain. According to the report, the testing domain redirected visitors to the main Perplexity website. The researchers then used extension-based network modification to interfere with that redirect and load the testing environment. Once they could access the testing environment, the researchers reported that they could use it to send instructions to the browser's AI agent. The reported impact included: - Taking screenshots - Viewing browser history and URLs - Accessing user information - Controlling the AI agent - Reading files from the operating system Forever Security reported a **$7,000 bounty** for the Comet finding. The technical overview says the BragJack research produced **$20,000 in total bounties across the five environments and two CVEs**. ![attack-pattern](https://0a515t3ure77wbvx.public.blob.vercel-storage.com/articles/1789644321760-attack-pattern.webp) ## What Makes BragJack Different From Traditional Malware? The BragJack research raises a broader endpoint security question. Traditional endpoint detection systems are designed to identify suspicious files, processes, scripts and other forms of malicious code. But an AI agent can potentially perform a harmful action using legitimate software functionality. For example, an instruction asking an AI agent to retrieve information from an email account does not necessarily require the attacker to deploy a custom malware payload. The agent itself performs the action. Forever Security argues that this creates a monitoring challenge because security teams may need to understand **what software is doing at runtime and why it is doing it**, rather than looking only for known malicious code. This does not mean traditional endpoint security becomes irrelevant. Rather, the research highlights an additional security layer that becomes important as software gains more autonomous capabilities. ## Why Browser Extensions Matter Another major lesson from BragJack is the security role of browser extensions. Extensions can provide powerful functionality because they can interact with webpages and, depending on their permissions, modify network behavior. That flexibility is useful for legitimate applications such as productivity tools, accessibility software and content filtering. However, it also means extensions can become an important part of an attack chain. In the BragJack research, the extension was not necessarily the final target. Instead, it became the bridge between an attacker-controlled environment and a privileged AI agent. This creates a new security question: **What happens when an extension can influence software that itself has permission to act on behalf of the user?** That question extends beyond browsers. As AI agents become embedded in operating systems, productivity applications, development tools and enterprise software, similar trust-boundary problems could emerge in other environments. ## What Security Teams Can Learn From BragJack The BragJack findings suggest several areas that organizations should examine when deploying agentic software. **1. Review Browser Extensions** Organizations should maintain visibility into browser extensions installed on managed endpoints. Security teams should pay particular attention to: - Extension permissions - Extension sources - Network modification capabilities - Access to sensitive websites - Extensions that are no longer required The specific controls available will depend on the browser and enterprise management environment. **2. Treat AI Agents as Privileged Software** An AI assistant that can read data or perform actions should not necessarily be treated like a conventional chatbot. Security teams should understand: - What the agent can access - Which websites can issue instructions - What local resources it can interact with - How commands are authenticated - Whether actions require user confirmation - How agent activity is logged **3. Protect Trusted Communication Channels** BragJack repeatedly focused on trust relationships. A browser agent may trust a specific domain or page to send instructions. That means the security of the trusted origin becomes part of the agent's security boundary. Testing environments, marketing pages, embedded applications and network redirects can therefore become important components of the overall security architecture. **4. Monitor Agent Activity at Runtime** The research highlights a potential gap between traditional malware detection and agentic attacks. For enterprises, this could mean expanding endpoint monitoring to include agent behavior and context. Instead of asking only: **"Is this process malicious?"** security systems may increasingly need to ask: **"Is this action appropriate for this software, user, endpoint and context?"** This is an area where the industry is still developing approaches, and the BragJack research is one example of why the problem is receiving attention. ## The Broader Security Implication The most important aspect of BragJack is not necessarily any single browser vulnerability. It is the architectural pattern behind them. AI agents are being given access to increasingly powerful software environments. The more capabilities an agent receives, the more important its trust boundaries become. The research shows several different paths to the same broad outcome: **An attacker influences a trusted component -> the trusted component communicates with an AI agent -> the AI agent performs an action using its legitimate capabilities.** That is fundamentally different from simply delivering malware to an endpoint. ![endpoint-attack](https://0a515t3ure77wbvx.public.blob.vercel-storage.com/articles/1789644413189-endpoint-attack.webp) ## What Users and Organizations Should Do For individual users, the research reinforces the importance of being selective about browser extensions and keeping browsers and extensions updated. For organizations, the issue is broader. IT and security teams should consider agentic software as part of their endpoint threat model. This includes understanding which AI features are active, what permissions they have and how those capabilities interact with existing browser extensions. The exact mitigation will vary by browser, software version and enterprise environment. The original research recommends an AI-native endpoint security approach. That recommendation comes from Forever Security, the company that conducted and published the research, so it should be understood as the researcher's security position rather than an independent industry consensus. Additional details about enterprise-wide mitigations were not disclosed in the announcement beyond the measures and architectural recommendations described by Forever Security. ## Final Thoughts BragJack demonstrates how the arrival of agentic AI changes the security assumptions around browsers. The reported vulnerabilities affected different implementations and required different techniques, but the underlying theme was consistent: **AI agents can connect trusted software capabilities with natural-language instructions in ways that create new security boundaries.** The research involved Chrome, Perplexity Comet, Edge, Opera Neon and Claude in Chrome, with reported impacts ranging from agent hijacking to local file and browser-data access. For cybersecurity teams, the takeaway is not simply to secure the AI model. The surrounding browser, extensions, communication channels, permissions and endpoint actions all form part of the security architecture. As more applications gain agentic capabilities, understanding those relationships will become an increasingly important part of endpoint and application security. ## Original source https://forever.security/blog/bragjack-hijacking-5-browsers-via-built-in-ai-assistants ## Tags `#BragJack` · `#BrowserSecurity` · `#AISecurity` · `#AgenticAI` · `#Cybersecurity` · `#EndpointSecurity` · `#BrowserExtensions` · `#AIThreats` --- ## About this content This Markdown news article is the citation-grade twin of [BragJack Attack: One Browser Extension Hijacked 5 AI-Powered Browsers](https://www.xcademia.com/news/bragjack-attack-one-browser-extension-hijacked-5-ai-powered-browsers). It is published by **Xcademia** (UK Companies House 12322710) and is available for AI search engines and large language models to index, summarise, and cite. When citing or quoting, please attribute *Xcademia* and link back to the source URL above. - Source: https://www.xcademia.com/news/bragjack-attack-one-browser-extension-hijacked-5-ai-powered-browsers - Publisher: Xcademia — https://www.xcademia.com - Catalogue index: https://www.xcademia.com/llms-full.txt