BragJack: A Single Extension Can Hijack the AI Assistants of Five Browsers

Browsers with a built-in AI assistant have a trust problem: the assistant obeys its own vendor’s domain, and a low-privilege extension can impersonate that domain. That’s BragJack, and it affects five browsers at once.

What BragJack Is and Who It Affects

Researcher Gal Weizman of Forever Security disclosed BragJack in September 2026: a technique that lets a single malicious extension hijack the AI assistants built into browsers. The proof of concept was demonstrated against five of them: Gemini Live in Google Chrome, Perplexity Comet, Microsoft Edge, Opera Neon, and Claude in Chrome.

One important condition: the attack requires the malicious extension to already be installed in the victim’s browser. This is not remote execution from an arbitrary web page.

How It Works: Not a Classic Prompt Injection

What makes this interesting is that BragJack doesn’t rely on tricking the model or getting around its guardrails. It exploits an architectural weakness in how the browser distributes trust among three pieces: the extension, the assistant’s privileged surface, and the vendor’s web application. A low-privilege extension can impersonate the domain the assistant is designed to obey.

Using the declarativeNetRequest API and its associated permissions, the extension can:

1. Weaken or strip the Content Security Policy of the page that loads the assistant’s frontend.
2. Redirect the JavaScript resources that page depends on to attacker-controlled servers.
3. Inject code that issues commands to the agent as if they came from the vendor’s trusted domain.

Weizman calls it “Prompt Forcing”: instead of sneaking an instruction into content the model reads, the agent is handed the full instruction through the channel it considers legitimate.

Comparison: Prompt Injection vs. BragJack

It’s worth telling the two classes of attack apart, because they are mitigated differently:

• Indirect prompt injection: the attacker hides instructions in content the agent reads. It is mitigated with isolation of untrusted content, least privilege, and human confirmation.
• BragJack: the attacker compromises the trust channel that carries commands to the agent. No model-side filter helps, because the command looks legitimate. It is mitigated by controlling which extensions run in the browser and by strengthening verification of where instructions come from on the vendor side.

What This Means for Your Company

Want an AI assistant and extension usage policy for your company? Write to us at info@guatemalia.com.