BragJack demonstration links one malicious extension to five AI browser assistants

Directing AI through an already-installed extension

Security researcher Gal Weizman of Forever Security described BragJack, a proof-of-concept technique he says was demonstrated against Gemini Live in Google Chrome, Perplexity Comet, Microsoft Edge, Opera Neon, and Claude in Chrome. The technique requires a malicious extension to be installed first. Once installed, the researcher says it can manipulate content or traffic trusted by browser AI components, issue prompts to an agent, and abuse the agent's existing permissions. The disclosure produced two CVEs and more than $20,000 in bug bounties; Google and Microsoft reportedly fixed the flaws assigned to them.

The demonstrated technique requires a malicious extension to already be installed; without that precondition, the reported BragJack attack path is not available.

A single installed malicious extension was reportedly shown to take control of AI browser assistants across five targets, with Google and Microsoft resolving the flaws assigned to them.

The reported technique shifts the concern from an extension merely accessing web content to an extension directing an AI agent that can read data or take actions in a browser. It also spans several AI-assisted browser designs rather than a single product.