A September 17, 2026, update said vendors had remediated all five BragJack findings. Gal Weizman of Forever Security disclosed the proof of concept on September 16, 2026, describing attacks across Google Chrome with Gemini, Perplexity Comet, Microsoft Edge, Opera Neon, and Claude in Chrome. The demonstrations required a malicious extension to be installed, but no further user clicks; the routes and reported effects differed by browser.
How an extension could reach a trusted AI agent
Browser extensions can interact with pages and browser traffic. The BragJack demonstrations used extension capabilities to reach browser AI components through paths that those components trusted. One capability involved was declarativeNetRequest, an extension API that can modify network requests. It played a role in some reported routes, not all of them.
Weizman calls the approach “Prompt-Forcing”: supplying a complete prompt and follow-up instructions through a browser component trusted by the AI agent, rather than hiding instructions in content the AI is reading.
Five environments, different paths and effects
The reported techniques ranged from substituting a JavaScript resource to injecting code on trusted domains. The demonstrated effects also varied by environment.
| Browser AI environment | Reported route | Reported impact |
| Google Chrome with Gemini | An extension altered a network request to substitute JavaScript used by Gemini. | Local-file access, screenshots, camera, and microphone. |
| Perplexity Comet | An extension removed a redirect, leaving testing.perplexity.com reachable. | Agent hijacking, local files, browser profile and history, and screenshots. |
| Microsoft Edge | Prompts from a privileged marketing page were combined with a race condition between “Think” and “Do” modes. | Browser-agent hijacking and actions on websites. |
| Opera Neon | Extension code was injected on the trusted opera.com domain. | Browser-agent hijacking; the demonstration requested an email summary and sending it. |
| Claude in Chrome | A marketing page sent prompts to the side panel; another extension could run code on Claude’s domain. | Browser-agent hijacking and email-summary exfiltration in the demonstration. |
The Chrome finding was associated with CVE-2026-0628; the Edge finding was associated with CVE-2026-55945. The routes and effects shown for those environments are specific to their respective demonstrations.
What browser users can do
The practical point is the extension prerequisite: review extensions that can read or change data on websites, and keep browsers and extensions updated. Broad website permissions deserve particular scrutiny, even though permission breadth alone does not make an extension malicious.
