A devastating new attack has been discovered, dubbed BragJack, which allows attackers to hijack the built-in AI assistant in five popular browser environments. This attack can be used to access sensitive information, execute malicious actions, and exfiltrate data without the user’s knowledge or consent.
Gal Weizman, an agentic software and browser vulnerability researcher at Forever Security, uncovered the attack and revealed that it was effective against Google Chrome with Gemini, Microsoft Edge, Opera Neon, Perplexity Comet, and Claude in Chrome. The attack didn’t require the usual tactics of bypassing AI guardrails or relying on prompt injection, but instead exploited a critical design flaw in how agentic browsers interact with extensions.
The flaw allowed attackers to hijack the communication channel between the browser and its built-in agent, forcing the agent to perform whatever actions they chose. Weizman explained that this was made possible because the agentic browsers didn’t have sufficient protection against malicious extension interactions. “They didn’t need to cleverly hide instructions in data the agent interacts with,” he said. “Instead, they could just send one prompt after the other until the agent got convinced to do anything.”
The BragJack attack was not a single vulnerability instance, but rather a novel type of attack that exploited different vulnerabilities in each of the five affected browsers. The manifestation of the attack varied depending on the browser and its specific vulnerability, but the underlying architectural problem was the same: each allowed a browser extension to cross a boundary that separated an untrusted extension from a highly privileged AI agent.
This means that hundreds of millions of users who used any of these browsers with at least one extension installed were at risk. The issues have since been resolved, with Google and Microsoft issuing CVEs for the flaws in their Chrome and Edge agentic browsers (CVE-2026-0628 and CVE-2026-55945 respectively).
The BragJack attack is a stark reminder of the dangers of AI agent manipulation. As AI technology becomes increasingly integrated into our daily lives, it’s essential to address these types of vulnerabilities before they can be exploited by malicious actors.
So what does this mean for users? It’s crucial to exercise caution when installing browser extensions and to regularly review their permissions. Additionally, using a reputable antivirus software and keeping your browser up-to-date with the latest security patches is vital in protecting against such attacks.
Source: Dark Reading — 2026-09-16