A newly identified attack strategy, known as BragJack, enables a malicious browser extension to hijack AI assistants in several popular browsers including Chrome, Edge, Opera Neon, Comet, and Claude in Chrome. This technique, demonstrated by Gal Weizman from Forever Security, manipulates trusted communication channels within these Chromium-based environments. Unlike traditional attacks that bypass model guardrails or embed instructions in web content, BragJack supplies direct commands to browser components, effectively turning an AI assistant into a tool for unauthorized actions and data theft.

The attack relies on content scripts and the declarativeNetRequest API, commonly used by ad blockers to alter network traffic. By exploiting these capabilities, the extension can breach a privileged AI control plane, allowing unauthorized code execution. The vulnerability stems from the architecture that connects an AI 'brain' on a vendor’s website to a 'body' within the browser. By manipulating the trusted web origin or an authorized page, the malicious extension can issue commands as if they were from the browser vendor itself.

This method, termed 'prompt forcing', contrasts with prompt injection by controlling the entire prompt sequence and bypassing model-level safety checks. Although Chrome’s Gemini blocked content-script injection, it failed to prevent DNR rules from accessing resources within the trusted WebView. This oversight allowed attackers to execute code in Gemini’s context, reading local files and capturing sensitive user data.

Google addressed this high-severity issue, identified as CVE-2026-0628, with a fix in Chrome versions 143.0.7499.192 and .193. The impact was most significant in Comet, where a trusted but unprotected domain allowed extensive unauthorized access. Opera Neon and Edge also showed vulnerabilities, with Edge requiring a complex attack chain to exploit a race condition.

While no real-world attacks have been reported, and the vulnerabilities have been patched, organizations are advised to promptly update affected browsers. Security teams should focus on maintaining strict extension controls and monitoring AI-agent activities to prevent such exploits.