The BragJack attack lets one malicious browser extension take control of the AI assistant built into Chrome, Microsoft Edge, Opera Neon, Perplexity Comet and Claude in Chrome. Forever Security published the research on 16 September 2026. Both flaws that received CVE numbers were already fixed, in Chrome in January and in Edge on 2 July 2026.
What BragJack Does Once an Extension Is Installed
It takes over the private channel between the assistant’s reasoning engine and the part of the browser that can actually touch your machine. A browser AI agent is split in two: a “brain” that runs on the vendor’s own website and a “body” inside the browser that opens files, reads tabs and clicks through sites on your behalf. The two halves trust each other because of where the messages come from.
BragJack breaks that trust. Gal Weizman, a browser and agentic software researcher at Forever Security, built a single extension that used Chromium’s declarativeNetRequest API, a legitimate feature that lets extensions rewrite network traffic, to intercept and redirect the scripts loading into the assistant’s privileged pages. With that in place, the extension could speak to the agent as though it were the browser vendor.
Weizman calls the result prompt forcing, and distinguishes it from prompt injection: “We didn’t insert a malicious ending into an existing prompt. Instead, we completely wrote and sent the entire prompt.” No guardrail was bypassed, because the attack arrives before the model is asked to judge anything. Forever Security sells endpoint security software, and its write-up ends with a pitch for its own product.
In demonstrations, the hijacked agents read local files, retrieved browsing history, took screenshots and summarised the user’s email back to the attacker. Reported impacts also include reaching the camera and microphone and acting on sites the user was already signed in to.
The Five Browsers and What Each Vendor Did
All five environments are Chromium-based, and one extension with browser-specific rules worked against all of them. Every vendor paid a bug bounty.
| Browser or agent | Weak point demonstrated | CVE and fix |
|---|---|---|
| Google Chrome (Gemini) | Network rules redirected assistant scripts to an attacker-controlled server | CVE-2026-0628, rated 8.8; fixed in Chrome 143.0.7499.192 in January 2026 |
| Microsoft Edge (Copilot Mode) | A race condition between the assistant’s “Think” and “Do” modes | CVE-2026-55945, rated medium; fixed in Edge 150.0.4078.48 on 2 July 2026 |
| Perplexity Comet | The agent trusted several Perplexity origins, including an unprotected testing domain | No CVE issued; bounty paid |
| Opera Neon | Code running on opera.com could send the agent arbitrary prompts | No CVE issued; bounty paid |
| Claude in Chrome | An over-permissive messaging interface reachable from Anthropic’s own pages | No CVE issued; bounty paid |
The bounties came to more than $20,000 across the five companies, ranging from $600 at the low end to $7,000 for the Chrome finding. Dark Reading and Cybersecurity News report that all five vendors have now patched; BleepingComputer’s account says only that Google and Microsoft resolved the flaws they were assigned, and does not confirm the state of the other three.
How to Check You Are Already Patched
Almost everyone reading this is. The Chrome fix shipped eight months ago and the Edge fix nearly three, and both browsers update themselves by default. The check takes under a minute.
- In Chrome, open the three-dot menu, then Help, then About Google Chrome. Any build numbered 143.0.7499.192 or higher carries the fix, and current releases are far beyond it.
- In Edge, open the three-dot menu, then Help and feedback, then About Microsoft Edge. You need 150.0.4078.48 or later.
- Let the browser finish downloading any update it finds, then relaunch. A Chromium update is not applied until the browser restarts.
- Open your extensions page and remove anything you do not recognise or no longer use. BragJack needs an extension already running on your machine; without one, none of it works.
- Review what your remaining extensions are allowed to do. Treat a request to read and change data on all sites as the serious permission it is.
As of 20 September 2026, there is no public evidence that BragJack has been used against anyone outside the research. It was a proof of concept, disclosed to the vendors and fixed before it was published. Our note on the latest round of Chrome security fixes covers how often these updates now arrive, and an earlier piece on dangerous browser extensions targeting Chrome and Edge users covers the cleanup in more detail.
Why This Is Different From the Prompt Injection You Have Read About
Prompt injection hides instructions in something the agent reads; prompt forcing replaces the instruction channel itself. That distinction decides which defences are relevant.
Against injection, the model is the defence: it can be trained to notice that a web page is trying to give it orders, and to refuse. Against forcing, the model has nothing to notice. The prompt arrives through the same authenticated channel the vendor uses, with the attacker choosing the wording, the timing and every follow-up command. Safety training cannot repair a trust boundary that was broken before the model was consulted.
This is why the fixes are browser fixes rather than model fixes. Google tightened policy enforcement on a privileged page, Microsoft closed a timing gap, and the other three vendors narrowed which of their own origins the agent will listen to.
What the Patches Do Not Solve
The specific holes are closed; the structure that produced them is not. Weizman’s conclusion is that an agent with this much reach creates exposure that is, in his words, “virtually impossible to predict or protect from.”
Three things follow from that, and none is addressed by a version bump:
- Extensions keep their privileged position: declarativeNetRequest is a supported feature, not a bug, and any extension granted broad site access sits between you and the agent.
- Vendor origins remain a soft target: in three of the five cases the weak point was a marketing or testing domain belonging to the vendor itself, not the browser engine.
- Agent actions are hard to audit: a hijacked agent performs the same operations a legitimate one performs, so there is little for a user to see and, for organisations, little in ordinary logs to distinguish the two.
Frequently Asked Questions
Is the BragJack Attack Still Dangerous?
Not on an updated browser. The two flaws assigned CVE numbers were fixed in Chrome 143.0.7499.192 in January 2026 and Edge 150.0.4078.48 on 2 July 2026, and all five vendors paid bounties and were notified before publication.
Did BragJack Ever Steal Anyone’s Data?
There is no public report of it being used outside the research. It was demonstrated as a proof of concept by Forever Security, which disclosed it to the affected vendors first.
Which AI Assistants Were Affected?
Gemini in Google Chrome, Copilot Mode in Microsoft Edge, the built-in agent in Opera Neon, Perplexity Comet, and Claude in Chrome. All five run on Chromium.
What Is Prompt Forcing?
It is the technique named in this research, in which an attacker writes and sends the agent’s entire prompt through a trusted channel rather than hiding instructions inside content the agent reads. The model’s safety filters never see anything suspicious because the instruction looks like it came from the vendor.
Do I Need to Remove My Browser Extensions?
Not all of them, but the attack requires one. Removing extensions you no longer use, and limiting which sites the rest can read and change, removes the only way in that BragJack used.
