{"schema_version":"0.10.0","id":"LR-2026-0729","record_version":1,"title":"BragJack malicious browser extensions hijack AI agents across five browsers","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":51.9,"score_breakdown":{"source_authority":12.1,"independent_corroboration":15.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":0.0,"completeness":3.2,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-11-01","extraction_run_id":null,"evidence_level":{"level":"confirmed","reason":"2 independent outlets","original_document":null,"reports_total":2,"reports_independent":2,"reports_derivative":0,"developing":false,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-11-01","history":[{"date":"2026-11-01","from_level":null,"to_level":"confirmed","reason":"2 independent outlets"}]},"sources_hash":"96d6f039540cfb653d797ac60171252f3d75f3a506ff2b888bff6ea836e9e929"},"system":{"model_name":null,"model_version":null,"developer":"unknown","harness":null,"tools_granted":[],"permissions_scope":null,"autonomy_level":"unknown","guardrails_present":[],"deployment_context":"unknown","tier":null,"lifecycle_stage":null,"integration_type":null,"intended_use":null,"safeguard_state":null,"production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2026-09-19","incident_class":"security_compromise","failure_class":null,"agent_involved":true,"secondary_failure_classes":[],"trigger":"unknown","duration":null,"detection_method":"public_researcher","summary":"A proof-of-concept called BragJack, reported by researcher Gal Weizman of Forever Security, showed that one malicious browser extension could take over AI assistants built into five Chromium-based browsers and assistants: Chrome's Gemini, Perplexity Comet, Microsoft Edge, Opera Neon and Claude in Chrome. The extension used content scripts and declarativeNetRequest rules to reach the trusted channels between each AI model and the privileged browser component that acts for it, so the agent carried out forced prompts. In the Chrome demonstration, the researchers gained the ability to read local files and capture screenshots. The attack requires the extension to be installed first. Researchers reported no in-the-wild attacks. Google and Microsoft assigned CVEs to the flaws and have since resolved them.","tags":[],"date_detected":null,"near_miss":null,"root_cause":"integration","root_cause_detail":null,"failure_class_detail":null,"responsible_party":null,"adversarial_actor":null,"input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":null,"precursor_events":null,"primary_risk":"RK04"},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"minor","severity_because":"Test: minor, meaning contained to one evaluation with no third party touched. Fact: the sources describe a proof-of-concept and state that researchers reported no in-the-wild attacks.","harm_class":[],"affected_description":null,"protected_class_involved":null,"data_categories_exposed":[],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://cybersecuritynews.com/bragjack-ai-agent-hijacking/","publisher":"CyberSecurityNews","date":"2026-09-19","type":"press","title":"BragJack Attack Lets Malicious Extensions Hijack AI Agents Across 5 Major Browsers - CyberSecurityNews","archived_url":null,"attachment":"first_report","independence":"independent"},{"url":"https://www.bleepingcomputer.com/news/security/bragjack-attacks-hijack-ai-browser-agents-through-malicious-extensions/","publisher":"BleepingComputer","date":"2026-09-19","type":"press","title":"BragJack attacks hijack AI browser agents through malicious extensions - BleepingComputer","archived_url":null,"independence":"independent"}],"per_field_confidence":{"event.incident_class":"C","event.agent_involved":"C","event.detection_method":"C","event.root_cause":"C","impact.severity":"D","impact.severity_because":"D","event.primary_risk":"D","event.summary":"C","system.autonomy_level":"D","system.deployment_context":"D","event.trigger":"D","context.country":"D","system.developer":"D","event.date_disclosed":"D","context.denominator_available":"D"},"field_citations":{"event.incident_class":[{"source_index":0,"quote":"A new attack technique dubbed “BragJack” allows a malicious browser extension to seize trusted communication channels used by AI assistants in Chrome, Edge, Opera Neon, Comet, and Claude in Chrome."}],"event.agent_involved":[{"source_index":1,"quote":"Once it is, the researcher shows the abuse can run without user interaction, letting an extension control an AI browser agent and abuse its existing privileges to access sensitive information or act on the victim's behalf."}],"event.detection_method":[{"source_index":1,"quote":"Security researcher Gal Weizman of Forever Security has disclosed a new attack technique that can hijack the AI assistants built into popular browsers using a single malicious browser extension."}],"event.root_cause":[{"source_index":0,"quote":"According to research published by Forever Security, the weakness lies in the architecture connecting an AI “brain” hosted on a vendor-controlled website to a powerful “body” inside the browser."}],"impact.severity":[{"source_index":0,"quote":"Researchers reported no in-the-wild attacks; the vendors paid approximately $20,000 in combined bounties."}],"impact.severity_because":[{"source_index":0,"quote":"Researchers reported no in-the-wild attacks; the vendors paid approximately $20,000 in combined bounties."}],"event.summary":[{"source_index":1,"quote":"Security researcher Gal Weizman of Forever Security has disclosed a new attack technique that can hijack the AI assistants built into popular browsers using a single malicious browser extension."},{"source_index":0,"quote":"The extension primarily used content scripts and the declarativeNetRequest API (DNR), which can modify network traffic."},{"source_index":1,"quote":"A privileged browser component then performs the actions, such as accessing tabs, reading content, taking screenshots, or interacting with websites."},{"source_index":1,"quote":"Unlike conventional prompt injection, where an attacker tries to slip malicious instructions into content an AI is already reading, Prompt Forcing lets the attacker hand the agent an entire prompt and the follow-up instructions."},{"source_index":0,"quote":"The researchers replaced a legitimate JavaScript resource and executed code within Gemini’s trusted context, gaining the ability to read local files, capture screenshots, expose profile information, and activate the camera or microphone."},{"source_index":1,"quote":"The attack requires the malicious extension to already be installed in the victim's browser."},{"source_index":0,"quote":"Researchers reported no in-the-wild attacks; the vendors paid approximately $20,000 in combined bounties."},{"source_index":1,"quote":"Both Google and Microsoft have since resolved the flaws they were assigned."}]},"notes_on_gaps":"No model name, version, single developer, harness, autonomy level, deployment context, or lifecycle stage is stated because the incident spans five vendors' products. Dates of occurrence and detection are not stated; disclosure date is taken from the article date. No trigger is stated beyond the malicious extension, so trigger is left out. failure_class is left out because the sources describe prompt forcing as distinct from prompt injection and no closed class fits. Adversarial actor, responsible party, direct loss, records, reversibility, industry and country are not stated. Severity minor is my judgement: the sources describe a proof-of-concept with no in-the-wild attacks. Only the Microsoft Think/Do separation is mapped to a control; the Gemini content-script block and other controls are not mapped because the sources do not name them as controls in the list. A Claude for Chrome issue from another incident in the sources was excluded. [case created by the backfill: read by claude-haiku-5-5, backfill-2026-11-01.2, 2026-11-01; not yet reviewed] [2026-11-01: evidence level set: Confirmed (2 independent outlets)]"},"context":{"industry":null,"org_size_band":null,"country":"unknown","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null}}