One Extension Can Hijack AI Assistants in Major Browsers

Security researcher Gal Weizman of Forever Security has demonstrated a method to hijack AI assistants built into popular web browsers. The technique, named BragJack, uses a single malicious extension to manipulate the behavior of AI agents in Google Chrome, Microsoft Edge, Opera Neon, Perplexity Comet, and Anthropic’s Claude in Chrome. This discovery highlights a growing risk as AI features become more deeply integrated into everyday browsing tools.

The attack relies on a legitimate browser feature that allows extensions to modify how network requests are handled. By altering these requests, the malicious extension can trick the browser’s privileged AI components into executing unintended actions. According to BleepingComputer, the research resulted in two CVEs and over $20,000 in bug bounties from the affected vendors, who have since patched the identified flaws.

Trusted components become weak points

Modern browsers grant AI assistants high-level permissions to read tabs, take screenshots, and interact with websites. Weizman describes this setup as having a brain that decides what to do and a body that performs the actions. The vulnerability lies in the fact that browser extensions can intercept the traffic that these privileged components rely on.

In the case of Chrome’s Gemini Live, the attacker could not directly inject code into the AI’s interface. However, by using the declarativeNetRequest feature to weaken security headers and redirect specific resources, the extension executed code within the Gemini context. This allowed the attacker to access local files, camera, and microphone data, bypassing normal security checks.

Agents forced to act on malicious instructions

For agentic browsers like Perplexity Comet, the impact is more severe because these agents can actively perform tasks on websites. Weizman found that the agent trusted certain testing domains that lacked proper protection. By redirecting traffic to these domains, the attacker injected scripts that controlled the agent.

The demonstration showed the agent being forced to visit specific sites, summarize the victim’s emails, and send the data to an external address. This shifts the threat from passive data theft to active manipulation, where the AI works against the user’s intent rather than just exposing their information.

Bypassing safety mode restrictions

Microsoft Edge attempts to mitigate these risks by separating thinking and doing modes, preventing the agent from executing arbitrary instructions. However, Weizman identified a race condition that temporarily disables this restriction. By quickly forcing a prompt and re-enabling action capabilities before the agent checks its state, the attacker bypassed the safety mechanism.

Similar vulnerabilities were found in Opera Neon and Claude in Chrome. The common thread is that AI agents are granted broad privileges that are difficult to fully isolate from standard browser extensions. Users should be cautious about installing third-party add-ons, as a single compromised extension can potentially undermine the integrity of the entire browser environment.