Security researcher Gal Weizman of Forever Security has disclosed BragJack, a proof-of-concept attack that uses a single malicious browser extension to seize control of the AI assistants built directly into popular browsers. The research was demonstrated against five targets — Chrome’s Gemini Live, Perplexity Comet, Microsoft Edge’s AI features, Opera Neon, and Anthropic’s Claude browser extension. Five vendors paid out a combined $20,000 in bug bounties and two CVEs were issued. The attacks run silently, with no user interaction required beyond having the malicious extension installed.
The core technique exploits a gap in how browsers grant AI assistants elevated privileges. Modern AI agents can browse tabs, take screenshots, read page content, and act on the user’s behalf — but the extension sandbox they trust is not hermetically sealed. Weizman found that Chrome’s declarativeNetRequest (DNR) rules, available to any extension, can intercept requests from the embedded Gemini app, weaken security headers, and redirect a JavaScript resource to run code inside the Gemini context. Against agentic browsers like Perplexity Comet and Opera Neon, the damage goes further: an attacker can hand the agent entire prompts and instructions, turning it into a proxy that reads emails, exfiltrates browsing history, captures local files, and relays everything to a remote address — all using the browser’s own trusted agent as the delivery mechanism. Weizman calls this “Prompt Forcing” to distinguish it from conventional prompt injection, where a malicious payload has to slip through content an AI is already reading.
How to check if you’re affected
Affected products include Chrome (with Gemini Live enabled), Perplexity Comet, Microsoft Edge AI features, and Opera Neon. Review every extension installed in your browser and remove any you did not explicitly install from a trusted source. All five vendors were notified before publication and are shipping fixes; check for browser and extension updates and apply them. Disable AI browsing features if you must keep an untrusted extension installed temporarily.