--- title: BragJack: how a malicious browser extension can hijack... description: Security researcher Gal Weizman disclosed BragJack, a proof-of-concept attack affecting AI assistants in five Chromium-based browsers: Chrome (Gemini Live),... canonical: https://daily.dev/posts/bragjack-how-a-malicious-browser-extension-can-hijack-your-ai-agent-ksifov1eb twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: BragJack: how a malicious browser extension can hijack your AI agent | daily.dev og:description: Security researcher Gal Weizman disclosed BragJack, a proof-of-concept attack affecting AI assistants in five Chromium-based browsers: Chrome (Gemini Live),... og:url: https://daily.dev/posts/bragjack-how-a-malicious-browser-extension-can-hijack-your-ai-agent-ksifov1eb og:image: https://api.daily.dev/og/posts/KSIfov1eB.png og:image:alt: BragJack: how a malicious browser extension can hijack your AI agent og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # BragJack: how a malicious browser extension can hijack your AI agent **[Collections](https://daily.dev/sources/collections)** · 2 min read · 1 upvotes · 0 comments ## Summary Security researcher Gal Weizman disclosed BragJack, a proof-of-concept attack affecting AI assistants in five Chromium-based browsers: Chrome (Gemini Live), Edge, Opera Neon, Perplexity Comet, and Claude in Chrome. The attack abuses a shared architectural flaw where a malicious browser extension already installed on a machine can use Chromium's declarativeNetRequest API to intercept traffic and inject code into the privileged AI agent context. Using a technique called 'Prompt Forcing,' an attacker can hand the agent a full malicious instruction set rather than injecting into existing prompts, enabling file/history reads, screenshots, camera/mic access, email exfiltration, and destructive actions on logged-in sites. All five vendors patched the issue; Google and Microsoft issued CVEs (CVE-2026-0628 and CVE-2026-55945), and the researcher earned over $20,000 in bounties. ## Content Security researcher Gal Weizman of Forever Security disclosed a proof-of-concept attack called BragJack that hijacks AI assistants built into five Chromium-based browsers: Google Chrome (Gemini Live), Microsoft Edge, Opera Neon, Perplexity Comet, and Claude in Chrome. ## How it works BragJack isn't a typical prompt-injection attack where malicious content on a webpage tricks an AI into doing something. It exploits a shared architectural flaw: untrusted browser extensions can cross into the privileged context where the AI agent runs. The attack uses Chromium's `declarativeNetRequest` API to intercept and redirect network traffic, letting a malicious extension execute code inside the AI assistant's privileged environment. From there, Weizman used a technique he calls "Prompt Forcing" — rather than injecting snippets into existing conversations, the attacker hands the agent a complete prompt with its own instructions, effectively taking full control of what the agent does next. A single malicious extension already installed on the victim's machine is all it takes. ## What an attacker can do Weizman demonstrated several impacts: - Reading local files and browsing history - Taking screenshots - Accessing the camera and microphone - Forcing agents to summarize and exfiltrate emails from authenticated accounts - Executing destructive actions on sites where the user is already logged in ## Patches and bounties All five vendors were notified and have patched the issues. Google and Microsoft issued CVEs — CVE-2026-0628 for Chrome and CVE-2026-55945 for a race condition in Edge. The research earned Weizman over $20,000 in bug bounties across the five programs. ## What to do Update your browser. Remove extensions you don't recognize or that request broad site-access permissions. If your browser exposes AI agent transcripts, it's worth checking them occasionally for anything unexpected. ## Questions this post answers ### What is the BragJack attack and which browsers does it affect? BragJack is a proof-of-concept attack disclosed by security researcher Gal Weizman that hijacks AI assistants built into five Chromium-based browsers: Google Chrome (Gemini Live), Microsoft Edge, Opera Neon, Perplexity Comet, and Claude in Chrome. It exploits a shared architectural flaw letting untrusted extensions cross into the AI agent's privileged execution context, rather than relying on typical webpage-based prompt injection. _Track fast-moving AI agent security disclosures like this one on daily.dev as browser AI features expand._ ### How does the BragJack attack technically compromise an AI browser agent? A malicious browser extension already installed on the victim's machine uses Chromium's declarativeNetRequest API to intercept and redirect network traffic, executing code inside the AI assistant's privileged environment. From there, a technique called 'Prompt Forcing' hands the agent a complete replacement prompt with new instructions, giving the attacker full control over what the agent does next, rather than injecting into an existing conversation. _Developers securing AI browser integrations can follow attack techniques like prompt forcing on daily.dev._ ### What CVEs were issued for the BragJack browser AI agent vulnerability? Google issued CVE-2026-0628 for Chrome, and Microsoft issued CVE-2026-55945 for a related race condition in Edge. All five affected vendors, including Opera, Perplexity, and Anthropic, were notified and patched the underlying issue, and the researcher who found it earned over $20,000 in bug bounties across the five programs. _Keep up with newly disclosed browser CVEs affecting AI features by following security patch news on daily.dev._ ## Similar posts on daily.dev - [BioShocking Attack Shows How AI Browsers Can Be Tricked Into Stealing User Credentials](https://daily.dev/posts/bioshocking-attack-shows-how-ai-browsers-can-be-tricked-into-stealing-user-credentials-bbuo1dpir) · Security Boulevard · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#ai-agents](https://daily.dev/tags/ai-agents), [#prompt-injection](https://daily.dev/tags/prompt-injection), [#chromium](https://daily.dev/tags/chromium) [View this post on daily.dev](https://daily.dev/posts/bragjack-how-a-malicious-browser-extension-can-hijack-your-ai-agent-ksifov1eb) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"BragJack: how a malicious browser extension can hijack your AI agent","url":"https://daily.dev/posts/bragjack-how-a-malicious-browser-extension-can-hijack-your-ai-agent-ksifov1eb","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/bragjack-how-a-malicious-browser-extension-can-hijack-your-ai-agent-ksifov1eb"},"datePublished":"2026-09-19T15:40:43.836Z","dateModified":"2026-09-19T15:41:25.035Z","description":"Security researcher Gal Weizman disclosed BragJack, a proof-of-concept attack affecting AI assistants in five Chromium-based browsers: Chrome (Gemini Live),...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/1c4914829c49315063e7ef552843f397?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/1c4914829c49315063e7ef552843f397?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Collections","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Collections","logo":"https://media.daily.dev/image/upload/s--fk_6ycEi--/f_auto,q_auto/v1780996001/logos/collections?_a=BAMAMiWQ0","url":"https://daily.dev/sources/collections"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/bragjack-how-a-malicious-browser-extension-can-hijack-your-ai-agent-ksifov1eb","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,ai-agents,prompt-injection,chromium","timeRequired":"PT2M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Collections","item":"https://daily.dev/sources/collections"},{"@type":"ListItem","position":3,"name":"BragJack: how a malicious browser extension can hijack your AI agent"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/bragjack-how-a-malicious-browser-extension-can-hijack-your-ai-agent-ksifov1eb#faq","mainEntity":[{"@type":"Question","name":"What is the BragJack attack and which browsers does it affect?","acceptedAnswer":{"@type":"Answer","text":"BragJack is a proof-of-concept attack disclosed by security researcher Gal Weizman that hijacks AI assistants built into five Chromium-based browsers: Google Chrome (Gemini Live), Microsoft Edge, Opera Neon, Perplexity Comet, and Claude in Chrome. It exploits a shared architectural flaw letting untrusted extensions cross into the AI agent's privileged execution context, rather than relying on typical webpage-based prompt injection. Track fast-moving AI agent security disclosures like this one on daily.dev as browser AI features expand."}},{"@type":"Question","name":"How does the BragJack attack technically compromise an AI browser agent?","acceptedAnswer":{"@type":"Answer","text":"A malicious browser extension already installed on the victim's machine uses Chromium's declarativeNetRequest API to intercept and redirect network traffic, executing code inside the AI assistant's privileged environment. From there, a technique called 'Prompt Forcing' hands the agent a complete replacement prompt with new instructions, giving the attacker full control over what the agent does next, rather than injecting into an existing conversation. Developers securing AI browser integrations can follow attack techniques like prompt forcing on daily.dev."}},{"@type":"Question","name":"What CVEs were issued for the BragJack browser AI agent vulnerability?","acceptedAnswer":{"@type":"Answer","text":"Google issued CVE-2026-0628 for Chrome, and Microsoft issued CVE-2026-55945 for a related race condition in Edge. All five affected vendors, including Opera, Perplexity, and Anthropic, were notified and patched the underlying issue, and the researcher who found it earned over $20,000 in bug bounties across the five programs. Keep up with newly disclosed browser CVEs affecting AI features by following security patch news on daily.dev."}}]} ```