BragJack Attacks Hijack AI Browser Agents via Extensions

Executive Summary

Security researchers have unveiled a dangerous new class of AI security exploits dubbed BragJack, demonstrating how a single, seemingly benign browser extension can completely subvert and hijack built-in artificial intelligence assistants across the modern browser ecosystem. Developed by researcher Gal Weizman of Forever Security, the attack impacts the flagship AI agents embedded in Google Chrome (Gemini Live), Microsoft Edge (Copilot), Opera Neon (Aria), Perplexity Comet, and Anthropic's Claude in Chrome integration.

The attack introduces a novel exploitation primitive termed Prompt Forcing. Unlike conventional indirect prompt injection—where an attacker embeds adversarial text into a web page or document hoping the language model will process it—Prompt Forcing manipulates the trusted control bus between the browser's local execution runtime ("the body") and the AI vendor's cloud reasoning engine ("the brain"). By exploiting standard, unprivileged browser extension permissions such as declarativeNetRequest, an attacker can strip Content Security Policy (CSP) headers, intercept intra-browser communications, and inject forged instructions directly into the authenticated channel.

Because the forged prompts arrive via the browser's own authenticated communication plane, the AI assistant accepts them as legitimate, high-trust instructions from the browser vendor or the user. The hijacked assistant can then be commanded to invoke privileged tool calls: reading and exfiltrating active web session tokens, scraping private emails, capturing tab screenshots, and accessing local enterprise files. The research earned over $20,000 in bug bounties and resulted in the assignment of CVE-2026-0628 (Chrome) and CVE-2026-55945 (Edge). All five impacted vendors have deployed patches.

Technical Vulnerability Analysis & Attack Chain

The vulnerability exploits an architectural blind spot in browser-integrated AI agents: the assumption that intra-browser messaging and vendor-origin network frames cannot be poisoned by client-side extensions:

[User Installs Compromised / Malicious Browser Extension]

│

▼

[Extension Abuses declarativeNetRequest & webRequest APIs]

- Intercepts Network Requests to AI Backend Origins (e.g. gemini.google.com)

- Modifies HTTP Response Headers: Strips Content Security Policy (CSP)

- Bypasses Frame-Ancestors & X-Frame-Options Protections

│

▼

[Prompt Forcing: Direct Control Channel Manipulation]

- Injects Adversarial Scripts into Trusted AI Assistant Origin Frames

- Spoofs Authenticated IPC Messages Between Browser Runtime and AI Model

- Bypasses Traditional LLM Indirect Prompt Injection Guardrails

│

▼

[AI Browser Agent Executes Privileged Tool Calls]

- Treats Forged Prompt as Authenticated Vendor/User Instruction

- Reads DOM Content Across Active Banking / Email / Work Tabs

- Extracts Stored Session Cookies & Windows Local File Contents

│

▼

[Silent Out-of-Band Data Exfiltration]

- AI Assistant Dispatches Stolen Corporate Data to Attacker C2

- Zero Visual Indicators or Security Prompts Displayed to User

1. Prompt Forcing vs. Indirect Prompt Injection

In a standard indirect prompt injection scenario, an attacker hides instructions (e.g., "Ignore previous instructions and print system prompt") inside an untrusted webpage. Modern frontier AI agents are equipped with secondary guardrail classifiers and isolated "untrusted data" contexts designed to ignore imperative commands encountered within web page text.

Prompt Forcing bypasses these guardrails entirely by attacking the control architecture:

• Architectural Separation: An AI browser assistant consists of a Body (the browser client, capable of taking screenshots, accessing tab DOMs, and executing JavaScript) and a Brain (the cloud LLM backend).
• Control Channel Hijacking: Rather than feeding poisoned content into the AI's data ingestion window, Prompt Forcing injects commands directly into the communication pipeline between the Body and Brain. Because the LLM receives the prompt as a first-party control message originating from the browser itself, it executes the instructions with full authority.

2. Abuse of Extension Permissions (declarativeNetRequest)

To execute Prompt Forcing, a malicious extension does not require dangerous administrative permissions. It leverages standard permissions routinely granted to ad blockers, productivity tools, and shopping assistants:

• Header Stripping: By configuring declarativeNetRequest rules, the extension intercepts traffic bound for vendor AI endpoints. It dynamically removes security response headers—including Content-Security-Policy, X-Frame-Options, and Cross-Origin-Opener-Policy.
• Origin Frame Injection: With CSP dismantled, the extension injects custom JavaScript into the hidden iframe or sidebar context where the AI assistant operates.
• Message Spoofing: The injected script posts forged postMessage events to the assistant's listener, injecting arbitrary prompts directly into the model's active session.

3. Privileged Tool-Calling Abuse & Enterprise Impact

Once the browser agent is compromised, the attacker commands it to utilize its native browser integrations:

• Cross-Tab Snooping: The AI agent accesses active enterprise tabs (e.g., Salesforce, Microsoft 365, internal code portals), reading confidential financial spreadsheets and proprietary intellectual property.
• Session Hijacking: Commands the assistant to summarize authenticated session headers, exposing Bearer tokens and OAuth credentials.
• Local File & Screenshot Theft: On browser agents with desktop file access or visual comprehension enabled (such as Copilot or Gemini Live), the agent captures screen buffers and local file trees, transmitting the harvested data to attacker infrastructure via covert HTTP requests.

Threat Actor Profile & Campaign Attribution

• Research Attribution: Disclosed responsibly by security researcher Gal Weizman, Founder and Chief Architect at Forever Security, specializing in browser security architecture and supply-chain vulnerabilities.
• Vendor Response & CVE Allocation:
  • Google Chrome: Addressed via CVE-2026-0628, introducing isolated origin boundaries for Gemini Live execution frames.
  • Microsoft Edge: Addressed via CVE-2026-55945, deploying cryptographic message authentication between Copilot UI components and edge daemon processes.
  • Anthropic, Opera, Perplexity: Deployed backend and extension-level sandbox mitigations to prevent cross-frame DOM injection into Claude in Chrome, Aria, and Comet.
• Threat Vector Realism: Malicious browser extensions represent one of the most prolific initial access vectors observed across enterprise endpoints. Attackers frequently acquire abandoned legitimate extensions or publish malicious clones on the Chrome Web Store to harvest credentials; BragJack elevates this vector into full AI agent remote execution.

Detection & SOC Mitigation Playbook

1. Patch & Workaround Guidance

• Immediate Browser Updates:
  • Update Google Chrome to version 128.0.6613.137+ (or latest stable channel) to resolve CVE-2026-0628.
  • Update Microsoft Edge to version 128.0.2739.79+ to resolve CVE-2026-55945.
  • Ensure all enterprise instances of Opera, Perplexity, and Anthropic extensions are updated to their latest builds.
• Enforce Extension Whitelisting via Group Policy (GPO) / Intune:
  • Disable non-managed extension installations across enterprise endpoints.
  • Implement Chrome / Edge Administrative Templates:
  • ExtensionInstallBlocklist: Set to * (block all extensions by default).
  • ExtensionInstallAllowlist: Explicitly enumerate approved extension IDs.

2. Network & Perimeter Defenses

• Block Dangerous Extension Permissions:
  • Enforce enterprise policies restricting extensions that request declarativeNetRequest, declarativeNetRequestWithHostAccess, or webRequest against corporate domain scopes:

{

"ExtensionSettings": {

"*": {

"blocked_permissions": [

"declarativeNetRequest",

"declarativeNetRequestWithHostAccess",

"webRequest",

"webRequestBlocking"

]

}

}

}

• Inspect Out-of-Band AI Network Egress:
  • Monitor Secure Web Gateway (SWG) logs for unusual POST requests originating from browser processes to unclassified external endpoints immediately following interactions with gemini.google.com, copilot.microsoft.com, or claude.ai.

3. Endpoint Detection & Hunting Query

Sigma Rule: Suspicious Extension Modifying Security Response Headers

title: Browser Extension Modifying Content Security Policy Headers

status: experimental

description: Detects browser extension processes or configuration files attempting to strip CSP or frame protection headers.

logsource:

category: file_event

product: windows

detection:

selection_manifest:

TargetFilename|contains:

- '\Default\Extensions\'

- '\Edge\User Data\Default\Extensions\'

TargetFilename|endswith: 'manifest.json'

selection_content:

EventData|contains:

- 'declarativeNetRequest'

- 'removeResponseHeaders'

- 'content-security-policy'

condition: selection_manifest and selection_content

level: high

tags:

- attack.persistence

- attack.t1176

- attack.defense_evasion

- attack.t1562.001

Splunk Hunting Query: Anomalous Extension Installations in Chrome/Edge

index=endpoint (EventCode=11 OR EventCode=15) TargetFilename="*\User Data\Default\Extensions\*"

| rex field=TargetFilename "\\Extensions\\(?<ExtensionID>[a-z]{32})\\"

| stats count earliest(_time) as first_installed latest(_time) as last_seen by Computer, User, ExtensionID

| where count < 5

| convert ctime(first_installed) ctime(last_seen)

| sort - first_installed