A research technique named BragJack shows how a malicious browser extension can take control of the trusted communication paths behind AI-powered browser agents. Demonstrations affected Chrome, Microsoft Edge, Opera Neon, Comet, and Claude in Chrome, with impact ranging from reading local files and browsing history to taking screenshots and acting inside authenticated websites.

The work does not describe an attack arriving directly from the internet. A hostile extension must first be installed. Once present, however, it can abuse browser capabilities that are common in legitimate products, including content scripts and the declarativeNetRequest API used to modify network traffic.

Prompt forcing targets the control plane

Traditional prompt injection hides adversarial instructions in material an AI system reads. BragJack instead attacks the authorization boundary before the model evaluates a request. Researchers call this “prompt forcing”: the extension controls the full instruction, its timing, and follow-up commands, then submits them through a channel the agent already regards as trusted.

Modern agentic browsers often divide the system into a web-hosted “brain” and a privileged browser “body.” The latter can inspect pages, operate websites, or reach local capabilities. If a vendor-controlled origin or an approved messaging page can talk to that body, an extension able to manipulate the origin’s resources or messages may impersonate the trusted controller. Model guardrails cannot reliably repair a broken security boundary outside the model.

Five products, different paths to control

In Chrome’s Gemini implementation, ordinary content-script injection into an embedded application was blocked, but network modification rules could still intercept resources loaded by its privileged WebView. The proof of concept replaced a legitimate JavaScript resource and ran code in Gemini’s trusted context. Google tracked the issue as CVE-2026-0628, rated 8.8, and fixed it in Chrome 143.0.7499.192 and .193.

Comet exposed the broadest demonstrated consequences because its agent trusted several Perplexity origins, including an insufficiently protected testing domain. By suppressing a redirect and injecting code there, the extension could communicate with the agent and reach history, screenshots, profile data, local files, and logged-in services. Opera Neon similarly allowed code on an Opera origin to pass arbitrary prompts to its agent.

Microsoft Edge required a race between its separate prompt and action modes. The researchers used an authorized Microsoft marketing page to provide a prompt, then switched modes at the right moment so the agent executed it. Microsoft assigned CVE-2026-55945 to the medium-severity race affecting releases before Edge 150.0.4078.48.

Claude in Chrome illustrated extension-on-extension risk. A permitted marketing page could feed instructions to the Claude side panel, while generated debugger privileges enabled the requested browser actions. In that case, one extension undermined another through an exposed privileged interface rather than compromising the browser itself.

Enterprise defenses should start with extensions

The findings were responsibly disclosed, vendors paid roughly $20,000 in combined bounties, and researchers reported no observed attacks. Organizations should nevertheless update affected browsers and assistants, then reduce the chance of a malicious extension gaining the required foothold.

• Use extension allowlists and remove tools that lack a clear business purpose.
• Closely review broad host, traffic-modification, and debugger permissions.
• Monitor unusual browser access to files, cameras, microphones, email, and business applications.
• Correlate agent prompts and actions with identity, endpoint, data-access, and network telemetry.

AI agents need stricter origin validation, isolated command channels, least-privilege capabilities, and explicit approval for sensitive operations. Vendors should also expose useful audit records so defenders can reconstruct which component supplied an instruction, what authority it received, and which browser actions followed. BragJack’s central warning is architectural: once software can translate a prompt into privileged action, the integrity of the path carrying that prompt matters as much as the model’s ability to recognize harmful language.