One Malicious Browser Extension Could Hijack AI Agents in Chrome, Edge, Opera, Comet and Claude, Researcher Shows

Big Tech spent the last two years shoving AI agents into browsers as fast as possible. A researcher just showed how flimsy the security around that rush actually is.

Gal Weizman, a researcher at Forever Security, published findings on September 16, 2026, describing an attack technique called BragJack. Using a single malicious extension requesting only two permissions common to ordinary ad blockers, Weizman demonstrated he could hijack the AI assistants built into five Chromium-based products: Google Chrome's Gemini Live, Microsoft Edge, Opera Neon, Perplexity's Comet browser, and Anthropic's Claude in Chrome extension, according to Weizman's write-up and reporting from Dark Reading, Bleeping Computer, and The Hacker News.

No user interaction was required once the extension was already installed. That's the catch and the caveat: the attack assumes the malicious extension has already made it onto the victim's machine, something users still have to be tricked into installing.

How It Actually Works

Security researchers have spent two years worrying about prompt injection, where an attacker hides instructions inside a webpage or document and hopes an AI model mistakes them for legitimate commands. Weizman says BragJack is different. He calls the underlying technique "Prompt Forcing."

"We discovered something worse," Weizman wrote, telling Dark Reading that all the vulnerabilities shared the same design flaw: the way these browsers route trust between an extension, the browser's privileged AI component, and the vendor's web application.

Weizman describes each system as having a "brain" and a "body," a framing echoed by Bleeping Computer, The Hacker News, and the Cloud Security Alliance's research arm. The brain is the large language model running on the vendor's servers. The body is a privileged piece of the browser that can see the screen, open files, and click things, but is only supposed to take orders from one trusted webpage, like gemini.google.com.

The extension needed just two permissions to break that trust: the kind that lets it modify webpages and Chromium's declarativeNetRequest API, which lets extensions redirect and rewrite network traffic. Together, according to Bleeping Computer's technical breakdown, those let the extension slip its own code into the trusted page and issue commands to the AI's privileged body directly. No guardrail-fooling required, because the attacker isn't talking to the model at all. It's talking straight to the component that carries out orders.

What Each Browser Exposed

The damage varied by product. The Hacker News reported that Comet was the worst case: Perplexity built its browser to be fully AI-driven, so once hijacked, the agent could read any file on the computer, list every site the user had visited, take screenshots, and act as the user. Weizman found Comet trusted a testing subdomain that lacked the same protections as the main perplexity.ai site, according to Bleeping Computer.

On Chrome, Weizman reported the access could read local files, capture screenshots, and potentially reach the camera and microphone. Edge, Opera Neon, and Claude in Chrome could be driven to act on the attacker's behalf, per The Hacker News.

Bounties, Patches, and a Timeline Gap

Two of the five findings became formal CVEs. Chrome's flaw, CVE-2026-0628, carries a CVSS score of 8.8 and traces back to research Weizman first published in March 2026 under the name GlicJack while affiliated with Palo Alto Networks' Unit 42, according to the Cloud Security Alliance's research team. Google patched it in Chrome version 143.0.7499.192. Edge's bug, CVE-2026-55945, rated a lower 4.2, was fixed in Edge version 150.0.4078.48 on July 2, 2026, per The Hacker News.

Comet, Opera Neon, and Claude in Chrome received no public CVE. The Cloud Security Alliance's write-up states plainly that all three were "remediated by their vendors without a public CVE assignment." Tech Times, by contrast, reported that patch status for those three products "remained unconfirmed at the time of the research's public release," a notably more cautious framing than the coordinated-disclosure account given by the Cloud Security Alliance and Bleeping Computer, which describe Weizman reporting each finding to vendors ahead of publication.

Across all five vendors, Weizman collected more than $20,000 in bug bounties, with individual payouts ranging from $600 to $7,000, according to Bleeping Computer.

This is a proof-of-concept, not an attack found in the wild. Every source, including the Cloud Security Alliance, notes there is no public evidence BragJack has been used against real users, and the flaws were disclosed responsibly before publication.

A technique built for one browser's AI panel in March 2026 generalized cleanly across four competing products within six months. Every major vendor built its agent on the same extension permission model. Nobody has shown a fix for that shared architecture, only patches for each individual vendor's implementation. The open question is whether the next researcher to poke at the next AI-integrated browser feature finds the same hole all over again.