BragJack Attacks Exploit AI Browser Agents via Malicious Extensions

The Emergence of BragJack Attacks

Recent security concerns have arisen with the disclosure of a new attack method known as BragJack, which specifically targets AI assistants integrated within popular web browsers. Security researcher Gal Weizman from Forever Security unveiled this technique on September 19, 2026. The core premise of the BragJack attack is the hijacking of AI agents built into Chromium-based browsers via a single malicious browser extension. This proof-of-concept attack has already demonstrated vulnerabilities in several widely used platforms, including Google Chrome's Gemini Live, Microsoft Edge, Opera Neon, and Anthropic's Claude in Chrome.

During his research, Weizman successfully acquired over $20,000 in bug bounties from the respective vendors, with individual payouts ranging from $600 to $7,000. Additionally, this research led to the assignment of two CVEs (Common Vulnerabilities and Exposures), highlighting the critical nature of the discovered vulnerabilities.

The Mechanics Behind BragJack Attacks

To execute a BragJack attack, the malicious extension must first be installed in the victim's browser. Once this is achieved, the attack can run autonomously without requiring any interaction from the user. The attacker can then collect sensitive information or perform actions on behalf of the user through the hijacked AI agent.

Understanding AI Assistants in Browsers

The exploitation largely hinges on how AI assistants are designed within modern browsers, transferring significant privileges and capabilities to these AI models. Weizman characterizes these systems as consisting of a "brain" and a "body." The AI  referred to as the brain  processes commands, while the browser component  called the body  executes actions like accessing tabs, reading content, and even taking screenshots.

Vulnerabilities in Browser Components

The security flaws exploited by BragJack are rooted in the trustworthy relationship between browser extensions and the privileged components that perform tasks. The same malicious extension used across various target browsers leverages the Chromium DeclarativeNetRequest (DNR) functionality, which allows extensions to modify network requests and response handling.

CVE Assignments and Rewards

Except for Microsoft Edge and Google Chrome, where the CVEs have been officially assigned, the rest are still pending resolution. Weizman's findings underscore a significant gap in browser security measures against such targeted attacks.

Specific Attack Scenarios

The BragJack attacks vary according to the capabilities of the AI agents they target. For instance, while Google's Gemini primarily reads data, agents in browsers like Perplexity Comet and Opera Neon possess additional functionalities, allowing them to perform actions on websites directly.

Attacking Perplexity Comet

In the attack against Perplexity Comet, Weizman bypassed restrictions by removing redirects to a testing domain that wasn't adequately protected. Consequently, he successfully loaded a content script that communicated with the built-in agent. This breach granted him access to the victim's browsing history, screenshots, local files, and the alarming capability to issue commands to the agent itself.

Microsoft Edge's Response

The case of Microsoft Edge posed unique challenges. The browser has designed its AI agent with separate "Think" and "Do" modes to curtail arbitrary commands. However, Weizman discovered a race condition that allowed him to temporarily disable this restriction. By forcing agent prompts, the security barrier was evaded, enabling instant actions under the agent's guise.

Implications for User Safety

This research is vital for enhancing cybersecurity protocols. The BragJack attacks connote a shift in attack strategies, with legitimate browser components being used as facilitators for malicious actions. Users are thus encouraged to keep their browsers up to date, delete unrecognized extensions, and be cautious about permissions that allow extensions to read and modify data from all websites.

Recommendations for Users and Developers

Following these findings, there are several recommended practices both for end-users and developers to safeguard against the BragJack attacks. Weizman emphasizes:

• Regular Updates: Keeping browser versions up to date to benefit from the latest security patches.
• Extension Management: Regularly reviewing and removing unrecognized or outdated browser extensions to minimize attack surfaces.
• Permission Awareness: Being vigilant with permissions requested by extensions, particularly those that encompass accessing all data across all websites.

What Lies Ahead in Browser Security

As the BragJack incidents exemplify, there will likely be more emerging threats that capitalize on the interconnectedness of AI and modern browser functionalities. The research spurred by this technique indicates a need for ongoing vigilance and adaptive security protocols to preemptively address these sophisticated threats.

Key Takeaways

• The BragJack technique exploits AI browser agents through malicious extensions, allowing extensive unauthorized access.
• The attacks affect multiple Chromium-based browsers, including Chrome and Edge, with verified vulnerabilities leading to considerable rewards.
• Users are advised to keep browsers updated and audit installed extensions regularly to mitigate risks.