Researcher Unveils BragJack Technique That Hijacks AI Browser Agents via Extensions
Security researcher Gal Weizman of Forever Security discloses BragJack, a new attack technique that hijacks the AI assistants built into popular browsers through a single malicious extension. The proof-of-concept targets five Chromium-based browsers and assistants: Google Chrome's Gemini Live, Perplexity Comet, Microsoft Edge, Opera Neon, and Anthropic's Claude in Chrome. The research earns more than $20,000 in combined bug bounties from the five vendors and produces two CVEs, with Google and Microsoft already resolving the flaws assigned to them.
The attack requires the malicious extension to already be installed in the victim's browser, but once present, it runs without further user interaction. The extension can control the AI browser agent and abuse its existing privileges to access sensitive information or act on the victim's behalf. Weizman describes these AI systems as having a "brain" and a "body," where the AI model processes instructions while a privileged browser component performs actions such as reading tabs, capturing screenshots, and interacting with websites. The flaw lies in how browser extensions can manipulate the web traffic and pages that these privileged components trust.
The same extension works across all five targets by relying on Chromium's declarativeNetRequest (DNR) functionality, which lets extensions modify network requests, change response headers, and redirect resources. In the Chrome attack, Weizman finds that while extensions are blocked from directly touching the privileged chrome://glic component or injecting scripts into Google's Gemini site, DNR rules can still intercept requests made by the embedded Gemini web app. By weakening security headers and redirecting a JavaScript resource, he executes code inside the Gemini context and communicates directly with Chrome's privileged AI component, gaining the ability to read local files, access web content, and take screenshots.