Independent researcher Gal Weizman (Forever Security) disclosed BragJack, a technique where a single Chromium extension needing only the declarativeNetRequest permission can hijack the built-in AI agents in Chrome, Edge, Opera Neon, Perplexity Comet, and Claude in Chrome, each through a different vendor-specific mechanism. The attack lands before the model ever evaluates content for intent, so it sidesteps safety filtering entirely. Vendors paid out roughly $20,600 combined; two of five findings have assigned CVEs so far.
The permission nobody flags as security-critical
declarativeNetRequest (DNR) is a standard Chromium extension permission, the kind that ships in ad blockers and privacy tools without raising an eyebrow in review. Weizman's research, published September 16, 2026 on Forever Security's own blog and picked up by BleepingComputer, The Hacker News, and cybersecuritynews.com starting September 19, shows what happens when that permission is the only thing an attacker needs.
The technique, which Weizman calls "DiNneR Serving," combines two DNR capabilities to strip security headers like Content-Security-Policy and document-isolation-policy from a page, then redirect legitimate JavaScript resource requests to attacker-controlled code. That code runs inside privileged browser contexts.
Prompt Forcing: skip the model, talk to the control channel directly
Most prompt injection research is about hiding an instruction inside page content and hoping the model reads and follows it. BragJack does something more direct. Weizman's "Prompt Forcing" sends forged, natural-language commands straight into the agent's backend control channel, the same channel the browser itself uses to talk to the agent.
Because the command never has to pass through the model's own content evaluation, there is no intent to filter. Weizman's own summary: "BragJack gives the attacker control over the complete prompt, its timing, and follow-up commands."
Five browsers, five different weak points
What makes this worth tracking isn't just the technique, it's that Weizman reproduced it against five separate implementations, each with its own specific mechanism:
→ Chrome / Gemini: direct access to privileged chrome://glic functions, reaching file, camera, and microphone access with no further user interaction
→ Microsoft Edge / Copilot: a race condition between the agent's "Think" and "Do" modes
→ Opera Neon and Perplexity Comet: trusted-page script injection
→ Claude in Chrome: debugger permissions used to inject prompts through a modified landing page
Demonstrated impact across the five included forcing an agent to visit attacker-chosen sites, read local files and browsing history, take screenshots, summarize a victim's email, and exfiltrate data, in several cases with zero user interaction.
What got fixed, and what's still open
Per Weizman's own itemized breakdown: Chrome/Gemini ($7,000, CVE-2026-0628, high severity), Microsoft Edge/Copilot ($5,000, CVE-2026-55945, medium severity), Perplexity Comet ($7,000, no CVE assigned), Opera Neon ($900, no CVE assigned; Opera says it found the same issue class independently around the same time), and Anthropic/Claude in Chrome ($600, no CVE assigned, credited as the first report of this specific finding). Chrome patched in 143.0.7499.192/.193; Edge patched before 150.0.4078.48. No source reviewed reports in-the-wild exploitation.
Three of five vendors still have no formally tracked CVE for their fix, which is worth watching rather than assuming means the issue is closed out.
The pattern this extends
This project has tracked the same shape of failure before in developer sandboxes: Docker Sandboxes' symlink and TOCTOU bugs, the GitSpawn class, DeepSeek Harness's loopback-networking gap. Each was marketed as the boundary that contains what an agent can do if it goes wrong. Each had at least one place where the boundary and the thing controlling it ended up on the same side.
BragJack is that pattern moving into consumer territory: not a developer's sandbox, but the AI agent built into the browser millions of people already use, reachable through a permission type nobody treats as sensitive.
Try it yourself
If you're building or running agents that sit close to a browser's privileged surfaces, worth adversarially testing what happens when the thing calling your agent isn't the UI you built for it.
pip install humanbound
Source, issues, and the full engine:
humanbound
/
humanbound
Open-source adversarial testing engine, SDK, and CLI for AI agents. Runs locally or against the Humanbound Platform.
humanbound
Open-source adversarial testing engine, SDK, and CLI for AI agents
Attack your agent the way real users and attackers will: live endpoints
multi-turn conversations, tool abuse. Then turn every failure into a firewall rule.
Runs locally or against the Humanbound Platform. No login required to start.
Quick Start · Test-to-Guardrail Loop · SDK · Documentation · Contributing
📖 Full documentation lives at docs.humanbound.ai — this README covers the essentials; the docs have the depth.
Why Humanbound
Most testing tools test prompts. Humanbound tests agents: it drives
multi-turn conversations against your real endpoint, probes tool use and scope
boundaries, and scores the results against your security policy. When tests
fail, hb guardrails converts the findings into deployable firewall rules —
so the same run that finds a hole also patches it.
Quick Start
Install
pip install humanbound # CLI + SDK, core deps
pip install humanbound[engine] # + OpenAI…References
- BragJack: How We Hijacked 5 Of The World's Most Popular Browsers Using Their Built-In AI Assistants (Forever Security)
- BragJack attacks hijack AI browser agents through malicious extensions (BleepingComputer)
- BragJack Attack Lets Malicious Extensions Hijack AI Agents Across 5 Major Browsers (cybersecuritynews.com)
- One Extension Could Hijack AI Assistants Across Chrome, Comet, Edge, Opera Neon and Claude (The Hacker News)
Top comments (0)