Browser Extensions Hijacked AI Assistants in Five Major Browsers

On 16 September 2026, Forever Security disclosed BragJack, a proof-of-concept attack that hijacks built-in AI assistants in five browsers: Google Chrome with Gemini, Microsoft Edge, Opera Neon, Perplexity Comet and Claude in Chrome. Researcher Gal Weizman said the work generated more than $20,000 in bug-bounty payments. The affected companies acknowledged vulnerabilities and paid rewards ranging from $600 to $7,000; Google and Microsoft assigned CVE-2026-0628 and CVE-2026-55945 respectively. The issues have since been resolved.

The attacks differed between products but exploited the same architectural weakness: an extension could cross a security boundary intended to separate untrusted extensions from a highly privileged browser AI agent. Unlike typical prompt-injection attacks, BragJack did not need to hide instructions in webpages. Researchers could take control of the communication channel and repeatedly send prompts to make the agent follow their instructions.

In Chrome, modifying network requests allowed attacker-controlled JavaScript to operate Gemini with access to screenshots, local files, the camera and microphone without user clicks. In Edge, researchers chained two weaknesses, including a race condition between “Think” and “Do” modes. According to Weizman, the agents could access emails, exfiltrate information and perform destructive actions on authenticated websites.

The article says any user of the five browsers with at least one extension installed was potentially exposed, although it does not report confirmed criminal exploitation.

Organisations are advised to update Chromium-based browsers, remove unvetted extensions and review AI-provider interaction records for suspicious activity. Weizman also recommends exporting browser-agent transcripts for investigation and considering endpoint protection capable of monitoring agentic operations.