As reported by BleepingComputer, security researcher Gal Weizman of Forever Security has disclosed a proof-of-concept attack dubbed BragJack that hijacks AI assistants embedded in five Chromium-based browsers using a single malicious extension. The research yielded two CVEs and over $20,000 in combined bug bounties from Google, Microsoft, Perplexity, Opera, and Anthropic.

Security Impact: As reported by BleepingComputer, security researcher Gal Weizman of Forever Security has disclosed a proof-of-concept attack dubbed BragJack that hijacks AI assistants embedded in five Chromium-based browsers using a single malicious extension.

Why This Matters: A New Trust Boundary Problem

BragJack is not just another browser extension exploit. It exposes a fundamental architectural weakness in how modern browsers integrate AI agents. These systems split responsibilities into a brain (the AI model that processes instructions) and a body (a privileged browser component that executes actions like reading tabs, capturing screenshots, or interacting with web pages). Weizman's attack demonstrates that the communication channel between these two layers is insufficiently isolated from manipulation by browser extensions.

The attack leverages Chromium's declarativeNetRequest (DNR) API — a legitimate extension capability used for content filtering and request modification — to intercept and alter network requests made by the embedded AI web application. By weakening security headers and redirecting JavaScript resources, the extension executes code within the AI agent's context, communicating directly with the privileged browser component and bypassing the AI's normal request flow.

Vulnerability Summary

CVE IDVendor / ProductSeverityStatus
CVE-2026-0628Google Chrome (Gemini Live)HighPatched
Second CVE (identifier not publicly disclosed in source)Microsoft EdgeHighPatched

Affected products: Google Chrome (Gemini Live), Perplexity Comet, Microsoft Edge, Opera Neon, and Anthropic Claude in Chrome. All are Chromium-based browsers or browser assistants with integrated AI agent capabilities.

Exploitation status: Proof-of-concept only. No active exploitation in the wild has been reported. However, the technique requires only that a malicious extension be installed — no additional user interaction is needed once the extension is present.

Who Is at Risk

Any organization whose users run Chromium-based browsers with AI assistant features enabled is exposed to this class of attack. The risk profile is significantly elevated for:
Who Is at Risk
Enterprise environments where users may install third-party extensions from the Chrome Web Store without administrative oversight
Agentic browser deployments (Perplexity Comet, Opera Neon) where the AI agent can take actions on websites — not just read content — increasing the blast radius of a compromise
Remote and hybrid workers who use browser-based AI tools for sensitive tasks like reading internal documents or accessing confidential web applications

The core issue is that browser extensions operate in a trust zone that overlaps with the AI agent's communication layer. Until vendors fully isolate the privileged AI component from extension-modifiable traffic, this class of attack will persist.

Broader Implications

BragJack signals a shift in the browser threat landscape. As browsers evolve from passive rendering engines into agentic platforms with autonomous action capabilities, the attack surface grows in ways traditional extension security models did not anticipate. The DNR API — designed for ad blocking and privacy filtering — becomes a powerful interception point when the browser itself is making privileged requests on behalf of an AI agent.

This research also underscores a gap in current browser extension review processes. Neither Google nor Microsoft caught these flaws before the AI integrations shipped, despite the extensions having access to the same DNR capabilities that enabled the attack. Vendors are building AI features faster than they are hardening the boundaries around them.

Shield53 Recommendations

Immediate Actions

  • Update affected browsers immediately. Ensure all endpoints are running patched versions of Chrome and Edge. Verify that Gemini Live and Edge AI features are updated to versions that include the BragJack fixes.
  • Audit installed browser extensions. Inventory all Chromium extensions across managed endpoints. Remove any extension that is not on an approved, reviewed allowlist. Pay particular attention to extensions requesting declarativeNetRequest permissions.
  • Enforce extension allowlisting. Use Group Policy (Edge) or Chrome Enterprise policies to block all extensions by default and permit only vetted ones via an allowlist.
  • Restrict DNR-capable extensions. Treat any extension requesting declarativeNetRequest with host access as high-risk. Require security review before approval, even for seemingly benign utilities like ad blockers.
  • Disable AI agent features on sensitive endpoints. For users handling highly confidential data, consider disabling integrated AI browser assistants until the agentic security model matures further.

Strategic Actions

  • Develop a browser security baseline that accounts for AI agent capabilities, not just traditional extension permissions. Document which users need agentic browser features and which do not.
  • Monitor for DNR abuse. Deploy endpoint monitoring that flags extensions modifying security headers or redirecting JavaScript resources — both are indicators of BragJack-style behavior.
  • Establish a browser extension governance program. Regularly review the allowlist, require security justification for new additions, and subscribe to vendor security advisories for Chromium and all deployed browsers.