Summary
- Forever Security demonstrated BragJack against Gemini Live in Chrome, Perplexity Comet, Microsoft Edge, Opera Neon, and Claude in Chrome.
- The attacks start with a malicious extension already installed, but some demonstrations then require no further user interaction.
- The research exposes how agent capabilities can amplify permissions and communication paths that were previously less consequential.
A malicious browser extension can interfere with AI assistants built into several Chromium-based products, according to new research that exposes how agentic features can turn existing browser permissions into a wider route to files, browsing data, sensors, and automated actions.
Forever Security demonstrated the technique, named BragJack, against Gemini Live in Google Chrome, Perplexity Comet, Microsoft Edge, Opera Neon, and Anthropic’s Claude in Chrome extension. The research resulted in two assigned CVEs and more than $20,000 in bug bounties across the affected vendors.
BragJack is not a remote compromise that installs an extension by itself. The attack begins with an extension already present in the victim’s browser. The security problem identified by the researchers is what that extension can do once AI functionality is available alongside it.
The demonstrations varied by product. Forever Security reported local file access and screenshot capabilities in some cases, access to browser history or profile information in others, and direct interference with an AI agent’s communication path across several products. Chrome demonstrations also included access to the microphone and camera.
Two vulnerabilities were assigned CVE identifiers: CVE-2026-0628 and CVE-2026-55945. The researchers received separate bounty awards from Google, Perplexity, Microsoft, Opera, and Anthropic, indicating that the affected vendors treated the underlying issues as security problems rather than expected extension behaviour.
The broader concern is the collision between two existing browser design choices. Extensions have long operated with permissions capable of seeing or modifying parts of a user’s browsing environment. Agentic assistants, meanwhile, are being given greater ability to interpret pages, access information, and act on the user’s behalf. Connections between the two can increase the consequence of a permission or messaging weakness.
That differs from many prompt-injection attacks, where malicious instructions are hidden in content consumed by the model. BragJack focuses on browser architecture and trusted communication channels around the agent itself. In several demonstrations, the researchers said the compromise did not depend on persuading the user to approve an additional AI action after the extension was installed.
Browser agents are increasingly intended to perform tasks rather than simply answer questions. That shifts the security requirement from protecting what a model can read to controlling what it can invoke, which identities it can act as, and which neighbouring browser components are allowed to influence it.
The issue is particularly relevant where organisations permit browser extensions while also enabling enterprise AI assistants. Extension approval historically centres on permissions, publisher trust, software provenance, and data access. Agentic functionality introduces an additional question: whether an extension can influence an automated system that holds broader contextual access than the extension was originally expected to possess.
The five affected implementations are not identical, and the researchers used different weaknesses to achieve different outcomes. BragJack therefore should not be treated as a single universal browser vulnerability. Its significance lies in the repeated architectural pattern uncovered across several independently developed products.
As browser vendors move AI functions closer to tabs, files, user profiles, and authenticated sessions, the boundary between an extension vulnerability and an agent vulnerability becomes less distinct. A component with modest privileges in a conventional browser can become more consequential when it sits beside software designed to interpret intent and take actions automatically.
