Malicious Browser Extensions Hijack AI Assistants, Exposing Sensitive Information
A new attack technique has been discovered that can take control of artificial intelligence (AI) assistants built into popular browsers using a single malicious browser extension. Dubbed BragJack, this proof-of-concept was demonstrated against five Chromium-based browsers or browser assistants: Google Chrome’s Gemini Live, Perplexity Comet, Microsoft Edge, Opera Neon, and Anthropic’s Claude in Chrome.
Security researcher Gal Weizman of Forever Security discovered the vulnerability and successfully exploited it to gain access to sensitive information, including browsing history, local files, and even control over the AI agent. The attack requires a malicious extension already installed on the victim’s browser, which can then run without user interaction. Once executed, the extension can abuse its existing privileges to access sensitive information or act on the victim’s behalf.
The BragJack attacks exploit the way AI assistants are increasingly integrated into browsers and granted browser-level capabilities. These systems have a “brain” – the AI model that processes instructions and decides what should happen – and a “body” – the privileged browser component that performs the actions, such as accessing tabs or reading content. The problem is that browser extensions can manipulate web traffic and pages that these privileged components trust.
Weizman’s research reveals that the same malicious extension was used across all five targets, relying on Chromium’s declarativeNetRequest (DNR) functionality. DNR allows extensions to modify how network requests are handled, including changing response headers and redirecting resources. By weakening security headers and redirecting a JavaScript resource, Weizman executed code inside the Gemini context, communicating directly with Chrome’s privileged AI component.
The resulting access was significant, allowing Weizman to read local files, reach web content, take screenshots, and potentially reach the browser’s camera and microphone. Google assigned the finding CVE-2026-0628 and paid a $7,000 bounty.
But BragJack attacks go further against browsers like Perplexity Comet and Opera Neon, which have agents that can act on websites rather than merely read them. Weizman demonstrated forcing the agent to visit specific websites, summarize email content, and send results to another address. Microsoft Edge presented a different challenge, with a race condition that briefly disables restrictions while allowing an extension to control the AI agent.
The implications of BragJack are alarming, as malicious extensions can now hijack AI assistants, exposing sensitive information and taking control of browser actions. Browser vendors have since resolved the flaws, but it’s essential for users to remain vigilant about the extensions they install on their browsers. To protect yourself, make sure to only install extensions from trusted sources and keep your browser up-to-date with the latest security patches.
By understanding the risks associated with BragJack, we can take steps to prevent these types of attacks in the future. As AI assistants become increasingly integrated into our browsing experience, it’s crucial that we prioritize their security and ensure they are not exploited by malicious actors.
Source: Bleeping Computer — 2026-09-19