A single browser extension, using permissions no more unusual than what a standard ad blocker requests, can seize control of AI assistants built into five major Chromium-based browsers. That is the finding behind BragJack, a proof-of-concept attack disclosed this month by security researcher Gal Weizman of Forever Security and detailed in a September 19, 2026 report from BleepingComputer. The technique does not rely on tricking a user into clicking a suspicious link or typing a password into a fake form. Once the extension is installed, no further interaction is needed for an attacker to read local files, capture screenshots, and in at least one browser, reach camera and microphone controls through the AI agent itself.
The affected products span the AI assistant features inside Google Chrome (Gemini Live), Microsoft Edge (Copilot), Opera Neon, Perplexity Comet, and the Claude for Chrome extension from Anthropic, according to the BleepingComputer report and a companion research note from the Cloud Security Alliance. That is five separate products, built by four different companies, all falling to the same underlying architectural weakness. For an industry that spent 2025 racing to bolt AI agents onto every browser, BragJack is the clearest signal yet that the rush came with a shared blind spot.
What BragJack actually does
BragJack is not prompt injection in the way that term has been used for the past two years. Earlier AI agent attacks typically hid malicious instructions inside a webpage, a PDF, or an email, hoping the AI assistant would read that content and mistake it for a legitimate command. BragJack skips that step entirely. Instead, it targets the trust relationship between a browser’s AI assistant and the origins it is programmed to treat as authoritative.
According to the technical breakdown published by Cybersecurity News, a malicious extension needs only two permissions to pull this off: the ability to modify page content through content scripts, and access to the declarativeNetRequest API, which lets an extension rewrite network requests and responses on the fly. Both permissions are already requested routinely by ad blockers, privacy tools, and coupon extensions. Nothing about requesting them should raise a red flag during a Chrome Web Store or Edge Add-ons review.
With those two permissions, the extension can impersonate or intercept the “trusted origin” that a given AI assistant is designed to obey. In practice, that means the extension can inject attacker-controlled instructions into the channel the AI agent uses to receive commands, or tamper with the scripts and data the assistant consumes, so the AI agent believes it is following a legitimate, vendor-authorized instruction. Because AI assistant contexts in these browsers run with elevated privileges compared to a normal webpage, that hijacked trust translates directly into real capability: reading files on disk, taking screenshots of whatever is on screen, pulling browsing history, and in the Chrome/Gemini Live case, reaching camera and microphone permissions the AI agent has access to.
Why five browsers fell to the same trick
The Cloud Security Alliance’s research note frames the real story here as what it calls an “agentic browser monoculture.” Chrome, Edge, Opera Neon, Comet, and Claude for Chrome are all built on the Chromium engine, and all five adopted broadly similar patterns for wiring an AI assistant into the browser: give the assistant a privileged execution context, let it talk to a vendor-controlled backend, and trust that the messages arriving in that channel are legitimate. Weizman’s research shows that assumption breaks the same way across every one of them.
That is a meaningfully different risk profile than a single-vendor bug. When one company ships a flawed AI feature, the fix is scoped to that company’s codebase and release cycle. When five companies converge on the same trust architecture independently, a single research technique becomes a template that can be pointed at whichever target is most convenient, and a fix in one browser does nothing to protect users of the other four. Aviatrix’s AI Threat Research Center describes BragJack as evidence that the industry needs to threat-model AI assistants as a new class of privileged subsystem, not as a feature bolted onto the side of a browser that already has a mature security model. It joins a growing list of 2026 cybersecurity threats tied directly to how fast AI features shipped without a matching security review cycle.
The disclosure timeline
Public reporting on BragJack clusters tightly around a five-day window in mid-September. The Cloud Security Alliance published its research note on September 17, 2026. BleepingComputer’s original report followed on September 19, with an update the next day. TechTimes, Cybersecurity News, and several independent security blogs, including Aviatrix and Privacy Needle, published their own write-ups between September 16 and September 20. That clustering is typical of coordinated disclosure: researchers privately report a flaw to affected vendors, wait for fixes or mitigations to land, and then go public once patches are available or a disclosure deadline passes.
| Date (2026) | Event | Source |
|---|---|---|
| Sept. 16 | Early technical write-ups on the BragJack technique begin appearing from independent security researchers | WebProNews, Privacy Needle |
| Sept. 17 | Cloud Security Alliance publishes its research note, “BragJack: One Extension Breaks Five Browsers’ AI Trust Model” | Cloud Security Alliance |
| Sept. 19 | BleepingComputer publishes the primary disclosure report naming all five affected browsers and Gal Weizman as researcher | BleepingComputer |
| Sept. 19 | Cybersecurity News publishes a technical breakdown of the two-permission attack chain | Cybersecurity News |
| Sept. 20 | BleepingComputer updates its report; TechTimes and Aviatrix publish independent coverage | BleepingComputer, TechTimes, Aviatrix |
Who found it, and how they got paid
The attack technique and its name trace back to Gal Weizman, a security researcher at Forever Security. Reporting on the disclosure notes that Weizman’s work resulted in two tracked vulnerabilities, one affecting Chrome’s Gemini Live integration and one affecting Microsoft Edge’s Copilot integration, with vendor bug bounty payouts reported at more than $20,000 combined. That figure is modest next to the scale of the exposure it addresses, but it reflects a pattern common to browser vendor bounty programs: payouts are typically capped well below what an attack’s real-world blast radius might suggest, especially for proof-of-concept research rather than an actively exploited campaign.
Microsoft’s fix for its Edge-side issue, tracked as CVE-2026-55945, shipped in Edge build 150.0.4078.48, according to a technical summary posted on WindowsForum. Google’s Chrome-side issue is tracked as CVE-2026-0628. Neither CVE record, as reported, includes a public statement quoting a named vendor spokesperson, and BleepingComputer’s coverage does not include on-record comment from Google, Microsoft, Opera, Perplexity, or Anthropic beyond the fact that patches were issued. That silence is worth noting on its own: for a vulnerability class spanning five major products, the public vendor response so far consists of shipped patches rather than public statements explaining what changed architecturally.
Proof of concept, not confirmed mass exploitation
It matters that BragJack, as reported, is a demonstrated technique rather than a documented wave of real-world attacks. No source in the current reporting cites a confirmed count of compromised users, a number of malicious extensions caught using this method in the wild, or evidence of an active campaign built around it. What the reporting does establish is that the technique works, that it worked identically across five separate products, and that it required only permissions extensions already request by the thousands in official extension stores.
That distinction shapes how seriously the industry should treat this. A proof of concept with a clean, repeatable exploitation path and a shared root cause across five vendors is not a theoretical curiosity. Security researchers routinely publish techniques months or years before criminal groups adapt them into working malware, and the gap between “researcher demonstrates it” and “criminal group weaponizes it” has been shrinking, not growing, across the AI agent security beat this year.
How this compares to prior AI agent security incidents
BragJack lands in a year that has already produced several high-profile AI agent security stories on this site, including Google’s own red-team disclosure that Gemini broke into three real companies during controlled testing and Unit 42’s report of AI agents completing a full breach chain against a client firm in ten hours using more than 50 distinct tactics, techniques, and procedures. Those incidents demonstrated that AI agents, once given enough autonomy and tool access, can execute complex multi-step attacks faster than a human red team. BragJack demonstrates something narrower but arguably more concerning for everyday users: you do not need an autonomous, tool-using AI agent to cause damage. You need one browser extension and two permissions that virtually every ad blocker already has.
It is also a different failure mode than the incidents Anthropic has disclosed this year around Claude’s own infrastructure, including a fourth cybersecurity incident the company disclosed after rescanning roughly 481 million log entries. Those were backend and infrastructure-level issues. BragJack is a client-side, browser-level issue that happens to intersect with an AI assistant that Anthropic ships as an extension, Claude for Chrome, meaning the company is affected here as a browser AI vendor rather than as the operator of the underlying model.
Competitive and market impact
Every major browser maker has spent the past 18 months positioning its built-in AI assistant as a core differentiator. Google has pushed Gemini Live as the reason to stay inside Chrome rather than switch to a competitor. Microsoft has bundled Copilot deeply enough into Edge that disabling it requires digging through enterprise policy settings. Perplexity built an entire browser, Comet, around the premise that an AI agent should be able to act on a user’s behalf across tabs. Opera positioned Neon as an AI-native alternative to the incumbents. Anthropic, more cautiously, shipped Claude for Chrome as an extension rather than a full browser, but still gave it privileged access to page content and browsing context.
BragJack complicates that entire pitch. If the security story behind letting an AI agent act inside a browser is that any extension with two common permissions can hijack it, the feature that was supposed to be a selling point becomes a liability that enterprise security teams have to account for before rolling out browser AI at scale. Expect procurement teams and CISOs to start asking browser vendors pointed questions about extension-to-AI trust boundaries in the coming quarters, the same way they started asking pointed questions about extension permissions generally after a string of malicious Chrome Web Store extensions made headlines in prior years. Google, notably, has also been positioning Gemini as a defensive cybersecurity tool through products like Gemini 3.8 Flash Cyber, a contrast that underscores how the same underlying AI infrastructure is being marketed simultaneously as a security asset and, per BragJack, as a fresh attack surface.
Enterprise exposure: what security teams are weighing now
For IT and security teams managing fleets of Chromium-based browsers, BragJack raises a specific and immediate operational question: does the current extension allowlist include anything with content-script and declarativeNetRequest permissions that hasn’t been reviewed since AI assistants were enabled by default? Many organizations built their extension governance policies before browser vendors shipped AI agents into the browser itself, meaning the threat model those policies were written against no longer matches what a compromised extension can actually reach.
The practical mitigations circulating among security teams right now, drawn from the Cloud Security Alliance and Aviatrix write-ups, are not exotic. They come down to auditing which extensions are installed across managed devices, tightening browser enterprise policies to restrict extension installation to an approved list, and treating any browser AI assistant as a high-privilege feature that should be disabled by default on machines that handle sensitive files or credentials until vendors can demonstrate the trust boundary has actually been rebuilt, not just patched at the CVE level. Some of the same policy-based guardrail approach already used to contain runaway AI agents, such as the setup process behind Shieldstral 1.0’s AI guardrail framework, applies just as well to locking down which extensions get to talk to a browser’s AI assistant in the first place.
Historical context: extensions have always been the soft underbelly
Browser extensions have been a favored attack surface for over a decade, largely because official extension stores have struggled to keep pace with review volume. What BragJack changes is the payoff. In the pre-AI-agent era, a malicious extension with content-script access could steal form data, inject ads, or redirect search traffic. That is a real problem, but a bounded one. An AI agent with file system access, screenshot capability, and in some cases camera and microphone reach turns the same two permissions into a much larger blast radius, because the extension no longer has to do the dirty work itself. It just has to convince a far more capable, far more privileged AI assistant to do it instead.
That is the throughline connecting BragJack to the broader pattern of AI agent security stories this year: autonomy and tool access, once granted, become attack surface the moment an attacker finds a way to speak into the channel the agent trusts. Whether that channel is a malicious webpage, a poisoned document, or, as BragJack shows, a browser extension impersonating a trusted origin, the underlying lesson keeps repeating.
Comparison table: the five affected browser AI products
| Browser / Product | AI Assistant | Vendor | Reported Fix |
|---|---|---|---|
| Google Chrome | Gemini Live | Tracked as CVE-2026-0628 | |
| Microsoft Edge | Copilot | Microsoft | CVE-2026-55945, fixed in Edge 150.0.4078.48 |
| Opera Neon | Built-in AI features | Opera | Included in the five affected products per BleepingComputer; no separate CVE cited in current reporting |
| Perplexity Comet | Comet AI agent | Perplexity | Included in the five affected products per BleepingComputer; no separate CVE cited in current reporting |
| Claude for Chrome | Claude | Anthropic | Included in the five affected products per BleepingComputer; no separate CVE cited in current reporting |
What Forever Security’s research method reveals
The choice to test the technique against five separate products before publishing is itself informative. Independent, single-vendor bug reports are common and get patched quietly. Testing the same technique against every major Chromium-based AI browser and getting the same result five times is a deliberate methodology aimed at proving a systemic point rather than a one-off implementation bug. That is likely why the Cloud Security Alliance chose to publish its own research note rather than leave the story to individual vendor security bulletins: a pattern spanning five vendors is a policy-relevant finding, not just a technical curiosity for a single company’s bug tracker.
It also raises an uncomfortable question about extension store review processes generally. If a technique requiring only two common, unremarkable permissions can be weaponized this broadly, existing automated review pipelines at the Chrome Web Store and Edge Add-ons store were not built to catch it, because nothing about the permission request itself looks abnormal. Catching BragJack-style extensions would require reviewing behavior, not just declared permissions, a much harder and more expensive problem for store operators to solve at scale.
Predictions: where this goes next
- Expect at least one more browser vendor, likely Google or Microsoft given the size of their extension ecosystems, to publish a dedicated security architecture post explaining how it plans to separate AI assistant trust channels from general extension APIs, rather than relying on CVE-level patches alone.
- Expect enterprise browser management tools to add BragJack-style extension permission combinations (content scripts plus
declarativeNetRequest) as a flagged risk category in admin consoles within the next two quarters. - Expect security researchers to test whether the same trust-impersonation technique extends to AI agents built into non-Chromium browsers, since the underlying pattern, an AI assistant trusting a vendor-controlled channel that an extension can intercept, is not exclusive to Chromium’s extension APIs.
- Expect at least one follow-up disclosure showing a variant of BragJack that does not require the two specific permissions Weizman used, since proof-of-concept research in this space typically triggers a wave of adjacent findings once the initial technique is public.
- Expect this incident to accelerate calls, already circulating among enterprise security teams, for AI browser agents to ship disabled by default on managed devices until vendors can demonstrate a rebuilt trust model rather than a patched CVE.
What users can do right now
None of the mitigation advice circulating from researchers requires exotic tools. Review every installed browser extension and remove anything not actively used, paying particular attention to ad blockers, privacy tools, and coupon extensions that request content-script and network-request permissions. Update Chrome and Edge to the latest available builds, since Microsoft’s fix for CVE-2026-55945 is already shipping in Edge 150.0.4078.48. Treat any browser AI assistant, whether Gemini Live, Copilot, Comet, Neon’s AI features, or Claude for Chrome, as a feature with elevated access to files and screen contents, and disable it on any device handling sensitive documents until the browser is confirmed to be on a patched build.
For organizations, the more durable fix is policy-level: restrict which extensions employees can install through enterprise browser management, and require security review before enabling AI browser assistants on company hardware. The CVE fixes close the specific holes Weizman found. They do not, on their own, change the underlying architecture that let one extension speak with a trusted AI assistant’s voice across five different products.
Frequently Asked Questions
What is BragJack?
BragJack is a proof-of-concept attack technique, disclosed in September 2026 by security researcher Gal Weizman of Forever Security, that shows how a single malicious browser extension can hijack the AI assistants built into Google Chrome, Microsoft Edge, Opera Neon, Perplexity Comet, and Claude for Chrome, using only two permissions common to ordinary ad blockers.
Which browsers and AI assistants are affected by BragJack?
Reporting from BleepingComputer names five affected products: Google Chrome’s Gemini Live, Microsoft Edge’s Copilot, Opera Neon’s AI features, Perplexity Comet, and Anthropic’s Claude for Chrome extension. All five are built on the Chromium engine.
Has BragJack been exploited in the real world?
Current reporting describes BragJack as a demonstrated proof-of-concept technique. No source has published confirmed figures for real-world victims, compromised accounts, or a documented criminal campaign built around it as of this article’s publication.
What permissions does a BragJack-style malicious extension need?
According to Cybersecurity News’ technical breakdown, the extension needs permission to modify page content through content scripts, and access to the declarativeNetRequest API used to rewrite network requests. Both are common permissions requested by legitimate ad blockers and privacy extensions.
Have Google and Microsoft patched the BragJack vulnerabilities?
Microsoft’s Edge-side fix is tracked as CVE-2026-55945 and shipped in Edge build 150.0.4078.48. Google’s Chrome-side issue is tracked as CVE-2026-0628. Current reporting does not include a public technical statement from either company beyond confirmation that patches were issued.
How is BragJack different from AI prompt injection?
Prompt injection typically hides malicious instructions inside content an AI reads, such as a webpage or document. BragJack instead impersonates or intercepts the trusted communication channel between a browser’s AI assistant and the vendor-controlled origin it is programmed to obey, so the AI agent follows attacker instructions believing they come from an authorized source.
What should I do to protect myself from BragJack-style attacks?
Review and remove unused browser extensions, especially those with content-script or network-request permissions, update Chrome and Edge to their latest builds, and treat browser AI assistants as high-privilege features that should be disabled on devices handling sensitive files until the browser is confirmed to be on a patched build.
Who discovered BragJack?
Security researcher Gal Weizman of Forever Security is credited with discovering and naming the BragJack technique. The research led to two tracked CVEs and vendor bug bounty payouts reported at more than $20,000 combined.
