A newly discovered attack technique is putting millions of browser users at risk of having their sensitive information hijacked by malicious extensions. Dubbed BragJack, this vulnerability allows hackers to manipulate AI-powered browser assistants, taking control of their actions and accessing confidential data without user interaction.
The attack was demonstrated against five popular Chromium-based browsers or browser assistants: Google Chrome’s Gemini Live, Perplexity Comet, Microsoft Edge, Opera Neon, and Anthropic’s Claude in Chrome. Security researcher Gal Weizman, from Forever Security, uncovered the vulnerability and earned over $20,000 in bug bounties for reporting it to the vendors.
To understand how BragJack works, consider how AI assistants are integrated into browsers. These systems consist of two main components: a “brain” (the AI model) and a “body” (a privileged browser component that performs actions). The AI model processes instructions and decides what should happen, while the privileged component executes these decisions. Weizman explains that browser extensions can manipulate web traffic and pages trusted by these privileged components, allowing them to inject malicious code.
The BragJack attack relies on a feature called declarativeNetRequest (DNR), which lets extensions modify network requests and alter response headers or redirect resources. In the case of Chrome, Weizman found that even though extensions were blocked from directly touching the privileged chrome://glic component, DNR rules could still intercept requests made by the embedded Gemini web app.
By weakening security headers and redirecting a JavaScript resource, Weizman was able to execute code inside the Gemini context, communicating directly with Chrome’s privileged AI component. This allowed him to access sensitive information such as local files, browsing history, and even control the browser’s camera and microphone.
The attack goes further against agentic browsers like Perplexity Comet and Opera Neon, which can act on websites rather than just read them. Weizman demonstrated how he was able to inject a content script into these agents, allowing him to browse history, take screenshots, and even send instructions to the agent.
Microsoft Edge presented a different challenge, as its agent had been split into “Think” and “Do” modes to prevent arbitrary actions. However, Weizman discovered a race condition that briefly disabled this restriction while forcing a prompt, then re-enabled action capability before the agent checked its state.
The good news is that both Google and Microsoft have since resolved the flaws they were assigned. However, the discovery of BragJack highlights the importance of maintaining robust security measures in browser extensions and AI-powered assistants. To protect yourself from similar attacks, we recommend keeping your browsers and extensions up to date, using strong passwords, and being cautious when installing new extensions.
Moreover, as more devices become integrated with AI-powered assistants, it’s essential for vendors to prioritize security and prevent such vulnerabilities from arising. By doing so, they can ensure that users’ sensitive information remains protected, even in the face of sophisticated attacks like BragJack.
Source: Bleeping Computer — 2026-09-19