Bragjack attack exposes a new risk for AI browser agents

BragJack is not another story about an AI model being fooled by a clever sentence. It is a browser security story.

In research published on September 16, 2026, security researcher Gal Weizman of Forever Security said a single malicious browser extension could reach the internal AI agents in five recognizable products: Gemini Live in Chrome, Perplexity Comet, Microsoft Edge Actions, Opera Neon, and Claude in Chrome.

The reported impact varied by product. Forever Security said the Chrome and Comet findings could expose local files, screenshots, profile data, or other sensitive browser context, while the Comet, Edge, Opera Neon, and Claude in Chrome paths could force the AI agent to act on attacker-supplied instructions. The research was disclosed as a proof-of-concept and vendor disclosure, not as a confirmed active exploitation campaign.

What BragJack is

BragJack targets the trust relationship between three parts of an AI browser setup: the browser, the built-in or attached AI agent, and the vendor-controlled web page or domain the agent is designed to trust.

Traditional browser security treats ordinary extensions and privileged browser surfaces as separate worlds. Extensions can modify web pages, but they are not supposed to command internal browser features. BragJack shows cases where that separation broke down because a browser agent accepted commands that could be influenced through extension-controlled paths.

Forever Security’s technical write-up describes the recurring pattern as a split between the agent’s body and brain. The body is the privileged browser-side component that can read pages, open tabs, take screenshots, access local resources, or act on web pages. The brain is the web app or AI service that supplies instructions. The attack works when an extension can get close enough to the trusted brain channel to send instructions the body accepts.

That makes BragJack different from classic prompt injection. Prompt injection usually relies on hidden or malicious content being read by the AI during an otherwise legitimate task. BragJack is closer to command-channel hijacking. The attacker is not merely trying to sneak bad instructions into content. The attacker is trying to become the source of the instructions.

The affected products and CVE status

Forever Security reported that the research affected five products, but the findings do not all have the same public vulnerability status. Two received CVE identifiers. Three did not, according to the public research table and Cloud Security Alliance’s follow-up analysis.

Product or feature	Public CVE status	Reported issue
Gemini Live in Chrome	CVE-2026-0628	Extension-driven script or HTML injection into a privileged Chrome WebView context, according to the GitHub Advisory Database and Forever Security.
Microsoft Edge Actions	CVE-2026-55945	A prompt-forcing path involving Edge’s AI action flow, according to Forever Security and Cloud Security Alliance.
Perplexity Comet	No public CVE listed in the Forever Security table	A trusted domain path could be abused to communicate with Comet’s built-in agent and trigger browser-level actions, according to Forever Security.
Opera Neon	No public CVE listed in the Forever Security table	Extension-controlled code under a trusted Opera context could send commands to the agent, according to the research.
Claude in Chrome	No public CVE listed in the Forever Security table	A co-installed extension could influence the Claude side panel through Claude’s own extension-adjacent flow, according to the research.

The Chrome finding was previously associated with GlicJack and is tracked as CVE-2026-0628. The GitHub Advisory Database describes it as insufficient policy enforcement in Google Chrome prior to 143.0.7499.192, where a malicious extension could inject scripts or HTML into a privileged page through a crafted Chrome extension. The advisory rates the Chromium issue as high severity.

Cloud Security Alliance said Chrome installations should be updated to at least 143.0.7499.192 and Edge installations to at least 150.0.4078.48 for the two BragJack variants with disclosed CVE identifiers and confirmed patch versions. Since browser versions move quickly, the practical check is not whether a device is exactly on those builds. The practical check is whether any managed fleet is still pinned below them or missing later stable updates.

Why AI browser agents change the risk calculation

Browsers have always been sensitive software because they sit between users, accounts, websites, extensions, files, and authentication tokens. AI browser agents add another layer: they are designed to interpret goals and perform actions inside that already sensitive environment.

That changes the value of a hijack. A malicious extension that once had to steal data directly may be able to ask an agent to gather it. A script that once needed custom logic for each website may be replaced by an instruction that tells the agent to navigate, summarize, click, copy, or send. The attacker still needs a foothold, such as an installed malicious extension, but the agent can make the next steps more flexible.

Forever Security uses the term Prompt Forcing for this class of attack, where the attacker supplies the full instruction stream rather than hiding instructions inside content the AI happens to read. That distinction matters for defenders. It shifts the question from whether the AI model can resist hostile text to whether the surrounding browser architecture verifies who is allowed to command the agent.

Cloud Security Alliance framed the issue as a trust-boundary failure between a low-privilege extension and a high-privilege AI surface. In that framing, the AI model is not the only security control. The browser, extension system, privileged pages, embedded web views, vendor domains, and agent communication channels all become part of the control plane.

BragJack fits a wider pattern in agentic browser research

BragJack is not the only recent warning about agentic browsers. University of Washington researchers studied seven agentic browsers in early 2026 and reported that four created conditions where malicious actors could bypass the same-origin policy if prompt-injection defenses failed. Their successful proof-of-concept attack targeted ChatGPT Atlas in Agent Mode, and they observed preconditions for similar cross-origin risks in Chrome with Gemini, Claude for Chrome, and Perplexity Comet.

Brave has also published research arguing that indirect prompt injection is a category-wide challenge for AI-powered browsers. In Brave’s testing, untrusted website content or even text extracted from screenshots could be passed into an agent in ways that blurred the boundary between trusted user intent and untrusted web content.

BragJack adds a different angle to the same direction of travel. Instead of focusing only on hostile web content being fed to an AI model, it highlights the danger of extension code reaching a privileged AI command channel. Both paths lead to the same security question: what is allowed to influence an agent that can act with browser-level access?

What organizations should do now

For businesses, BragJack is another reason to treat browser extensions as managed endpoint software rather than harmless add-ons. That is especially true on devices where employees are signed in to email, cloud storage, CRM systems, finance tools, admin panels, or internal dashboards.

• Audit installed extensions. Approved extension lists should be reviewed, especially for broad host permissions, request-modification permissions, scripting access, and debugging access.
• Keep browsers and AI extensions updated. Chrome and Edge baselines should be checked against the fixed versions cited in public advisories, and later stable versions should be deployed where available.
• Separate agentic browsing from sensitive sessions where possible. A dedicated profile, browser, or managed environment can reduce the chance that an experimental agent has access to every signed-in account.
• Limit agent permissions by default. Camera, microphone, local-file, and cross-site action capabilities should be enabled deliberately, not treated as background conveniences.
• Watch for agent actions, not just malicious code. If an AI agent sends an email, opens a file, exports data, or changes a setting, that action should be logged in a way security teams can review.

Individuals face a simpler version of the same problem. Browser extensions should come from trusted sources, old or unused extensions should be removed, and agentic browser features should not be granted more access than the task requires.

The bigger security shift

AI browser agents are moving from demos into products people recognize by name. Chrome, Edge, Comet, Opera Neon, and Claude in Chrome are not obscure experiments. They represent a direction many software makers are already pursuing: put an AI agent close to the place where work happens.

That direction creates real convenience. It also concentrates trust. The more an agent can do, the more valuable its command path becomes. BragJack shows how that path can become the target.

Future fixes will likely need more than patching individual bugs. Browser makers will need stricter separation between extensions and agent control surfaces, stronger origin and provenance checks for instructions, clearer user approval for sensitive actions, and better isolation between normal browsing and agentic browsing.

BragJack’s enduring warning is simple: an AI assistant inside a browser is not just another feature. It is a privileged actor. Once software can read, click, type, summarize, and act across accounts, the question is no longer only what the AI model will do. It is who is allowed to make it do anything at all.

Get new small business insights by email

Practical ideas and useful articles to help you make better business decisions.

Email address

Subscribe Submitting

No spam. Unsubscribe anytime. Privacy policy .

Check your inbox

Confirm your email to complete your subscription. If the message doesn’t arrive shortly, check your spam folder.