Security researcher Gal Weizman at Forever Security disclosed BragJack, a technique showing that a single ordinary browser extension could take over the built in AI assistants of five Chromium based products: Gemini Live in Chrome, Perplexity Comet, Microsoft Edge, Opera Neon, and the Claude in Chrome extension. Depending on the product, a successful hijack let the extension drive the AI agent to act on the attacker’s behalf, read local files, or in Chrome’s case access the camera and microphone, all without the user clicking anything once the extension was already installed. Google, Anthropic, Microsoft, Perplexity, and Opera paid a combined total in the tens of thousands of dollars in bug bounties and fixed the underlying flaws, tracked as CVE-2026-0628 (Chrome) and CVE-2026-55945 (Comet).
Why it matters: each of these AI assistants is built the same way, a “body” inside the browser that can act on the user’s behalf and a “brain” that runs on the vendor’s servers and is supposed to take instructions only from one trusted page. Forever Security’s research showed an extension holding only two ordinary, widely granted permissions could insert itself into that trusted page and issue commands the AI body would treat as legitimate, without bypassing any AI guardrail or using prompt injection at all.
The original insight is that this is a browser extension problem wearing an AI problem’s headline. Extensions have carried outsized, poorly scrutinized privileges for years; what changed is that browsers just gave every extension a new, more powerful thing to abuse by wiring a high privilege AI agent into the same trust boundary. Your AI Agent Sandbox Is Just an Honor System made the broader case that agentic tools inherit the trust of whatever surface they run inside; BragJack shows the browser itself is one of those surfaces. Security teams should audit which extensions are approved for AI enabled browsers with the same scrutiny given to endpoint agents, not the lighter review extensions have traditionally received, a gap Attackers Don’t Need an Exploit. They Ask the Agent. flagged as a blind spot in enterprise AI governance.
Source: Forever Security
