BragJack: a Browser Extension Hijacks AI Agents

CVE-2026-0628: control of the agent runs through the extension

CVE-2026-0628, with a $7,000 bounty paid by Google, turns a Chrome extension's network rule into code execution inside Gemini's context. Researcher Gal Weizman of Forever Security published the technique on 19 September 2026, under the name BragJack.

The chain demands one precondition: the hostile extension already present in the victim's browser. From that point the rest runs at zero user interaction, zero clicks, zero consent.

The proof of concept hit five Chromium targets: Gemini Live in Chrome, Perplexity Comet, Microsoft Edge, Opera Neon and Claude in Chrome. According to the report published by BleepingComputer on 19 September 2026^[1], the five vendors paid out more than $20,000 in bounties, in a range from $600 to $7,000, and the research produced two CVEs.

Brain and body: the trust boundary that isn't there

Weizman describes these systems as a pair of components. The model reasons over the instructions and decides the action: that is the "brain". A privileged browser component carries it out: that is the "body".

That component opens tabs, reads page content, captures screenshots and acts on sites. It carries the browser's privileges with it, which means the user's full privileges.

The flaw lives in the channel between the two. The privileged component trusts the pages and the traffic reaching the model, and that traffic remains rewritable by a local third party.

An installed extension thus becomes the authority dictating the agent's actions. The prompt typed by the user drops to the rank of just another input, and the least privileged one in the chain at that.

declarativeNetRequest: the primitive that rewrites traffic

The same extension worked on all five targets, leaning on a standard Chromium feature: declarativeNetRequest. DNR lets an extension change how network requests are handled, response headers and resource redirects included.

In Chrome the defences existed and were explicit. The extension was barred from touching the privileged chrome://glic component and barred from injecting scripts into the Gemini site.

The DNR rules sidestepped both prohibitions laterally. The researcher intercepted the embedded Gemini web app's requests, weakened the security headers and redirected a JavaScript resource.

The result is code executing inside Gemini's context, in direct dialogue with Chrome's privileged AI component. The app's normal request flow is bypassed. The attack surface is the browser's local traffic, and control passes to whoever rewrites it.

Blast radius: local files, screenshots, peripherals

The access obtained in Chrome covers reading local files, web content and screenshot capture, with an open path toward camera and microphone. Google and Microsoft have already fixed the flaws assigned to them.

A retrieved document, a rewritten response, a substituted resource: any one of these is enough to move the agent. The system an agent reaches is the system an agent compromises.

The perimeter here coincides with the corporate browser profile. Active SaaS sessions, cookies, password managers, documents open in a tab: it all falls within the hijacked agent's radius.

A patch from two vendors leaves the question open on the other three. The public report documents Google's and Microsoft's fixes; for Perplexity, Opera and Anthropic the picture remains to be verified against their respective advisories.

From agents that read to agents that act

Comet and Neon raise the stakes. Their agents act on sites as well as reading them, so hijacking shifts from data leakage to action on the victim's behalf.

In Comet's case the researcher found that the agent extension built into the browser trusts various Perplexity domains. Trust in a domain is worth exactly as much as an extension's ability to rewrite that domain's responses.

This is the difference between a confidentiality incident and an integrity incident. An agent that fills in forms, clicks and submits operates with the user's identity on every already-authenticated service.

Those services' audit logs record the user. The distinction between a human action and a hijacked agent's action disappears from the records, and with it the ability to reconstruct the incident.

The root condition: implicit trust in the channel

The underlying condition unites BragJack and the prompt injection family. In both cases content retrieved from the outside travels with the user's credentials and reaches the decision engine as a legitimate instruction.

Most RAG architectures in production treat the retrieved document as trusted data. In-browser assistants repeat the pattern one level lower: the transport channel becomes the vector.

The opposite reading also holds, and it is correct. BragJack requires prior implantation, because the hostile extension has to be installed, so the attack starts from a compromise that has already happened.

This narrows the pool, and raises the value of the target. An extension with broad permissions is a market commodity, it changes owner and receives automatic updates: the extension supply chain threat model moves inside the agent's perimeter.

Three questions for enterprise AI teams

The operational issue here is browser fleet management, before the choice of model. The three useful questions for the next security committee remain direct.

1. What inventory exists of the extensions installed on the browsers hosting AI assistants, with declared permissions and owner?
2. Which agents across the browser estate have the ability to act on sites, beyond reading?
3. What corporate policy blocks the installation of extensions outside the allowlist on profiles that touch regulated data?

The practical answer runs through a Chrome or Edge enterprise policy with a strict extension allowlist. It is a mature control, available for years, and it is the most effective brake against this class of attack.

The secondary control is profile separation. Agentic assistants live on a dedicated profile, with no administrative sessions and no access to code repositories.

Decisions for the next planning cycle

For the CTO the question is blunt: is this architecture a trap or a competitive advantage? Today's verdict depends on the degree of control over the extension estate, more than on the assistant's vendor.

For the Head of Engineering the point concerns the execution boundary. A production-grade browser agent demands independent validation between page content and privileged action, with explicit circuit breakers on write operations.

For the CFO the calculation changes little on licence cost and a great deal on control cost. The technical debt here is paid in fleet management, in logging and in incident response.

For the procurement committee the contract should be reopened on three items: stated patch timelines, a public advisory channel and per-user logs of the agent's actions. A bounty paid counts as a signal of process, and the signal that matters remains the documented patch.