One extension hijacked the AI inside five browsers

Security researchers have found a way to hijack the AI assistants built into five of the most widely used browsers, and everything they needed is already sitting inside the extensions installed on your machine.

What BragJack actually does

Gal Weizman of Forever Security published the research, named BragJack, on 16 September. The technique leans on two capabilities extensions receive almost by default: content scripts, which let an extension inject JavaScript into a website, and declarativeNetRequest, which lets it rewrite network traffic. Browsers are supposed to be immune to this because an extension is only ever allowed to touch websites, never the browser itself. The flaw is that every browser's assistant takes its orders from a web page the browser trusts: Gemini for Chrome, a marketing page for Microsoft Edge, perplexity.ai for Comet, opera.com for Neon, and Anthropic's own page for Claude in Chrome.

By changing which script that trusted page loads, or by stripping a redirect that hid a testing domain the developers had left behind, an extension can reach the assistant directly. The assistant then does what it exists to do and acts on the instructions it receives. Google's flaw became CVE-2026-0628 and Microsoft's was tracked as CVE-2026-55945, and all five vendors paid bounties ranging from 600 dollars to 7,000 dollars. The report says no clicks from the user are required, only that the malicious extension is already installed.

Comet was the worst of the five

Perplexity's Comet came off worst because the entire browser is built around its agent, and that agent inherits the browser's full permissions. According to the write-up, the researcher reached a leftover testing domain, blocked the redirect that normally hides it, and from there controlled the assistant. From that position the research claims local file access, visibility of the user's browsing history, screenshots, and the ability to order the agent around as though it were the user. Comet carried the joint largest bounty at 7,000 dollars. Microsoft's Edge took the most work and needed two flaws chained together, including a race condition that flipped the assistant out of its read-only mode and into its acting mode mid-thought.

Weizman calls the approach Prompt-Forcing rather than prompt injection, and the distinction is the whole point. A prompt injection smuggles an instruction into text a model was already going to read. Prompt-Forcing writes the entire instruction and every follow-up, so there is no malicious payload left to find. The researcher's argument is that endpoint detection tools hunt for code, and this attack contains none: the assistant is simply being told, in plain language, to do something it is allowed to do.

Our opinion

The uncomfortable lesson is not that browser assistants are badly built, because Microsoft plainly tried hard here. It is that the industry bolted a general-purpose agent onto the browser, handed it the browser's permissions, put it behind one trusted page, and assumed a trust boundary designed for scripts would hold. It does not, because an agent is instructed in language rather than code, and language has no signature to scan for. Every vendor named paid up, which is a frank admission that the findings are real. What matters next is the shape of the fix. Tightening which page may speak to an assistant addresses the mechanics, not the concept, and any software that lets an assistant act as you will keep having this exact conversation. Extensions remain the cheapest way in.