Cases › security breach › LR-2026-0729
BragJack malicious browser extensions hijack AI agents across five browsers
Confirmed Why: 2 independent outlets · 2 independent reports
Status: no action reported
No source states: loss or records, developer and model, agent tool, could do, deployer, industry.
Severity minor: Test: minor, meaning contained to one evaluation with no third party touched. Fact: the sources describe a proof-of-concept and state that researchers reported no in-the-wild attacks.
A proof-of-concept called BragJack, reported by researcher Gal Weizman of Forever Security, showed that one malicious browser extension could take over AI assistants built into five Chromium-based browsers and assistants: Chrome's Gemini, Perplexity Comet, Microsoft Edge, Opera Neon and Claude in Chrome. The extension used content scripts and declarativeNetRequest rules to reach the trusted channels between each AI model and the privileged browser component that acts for it, so the agent carried out forced prompts. In the Chrome demonstration, the researchers gained the ability to read local files and capture screenshots. The attack requires the extension to be installed first. Researchers reported no in-the-wild attacks. Google and Microsoft assigned CVEs to the flaws and have since resolved them.
What happened
No source tells the story step by step yet.
What was done
No source states an action or fix.
Risks
Read from the sources; not yet reviewed by a person.
Controls
Not yet read for controls. Controls that mitigate the primary risk:
Harness ApplicationSensitive-data checks on outbound data · Output filtering and redaction · Human approval for high-impact actions · Data minimisation · Least-privilege access for the agent · Activity logs
Evidence
- Cause a permission, scope or wiring error
No source states: a step-by-step account, when it happened, when it was found, how many records were exposed, the direct loss, a count of the other parties affected, any court case, what set it off, what was done.
Show every field, with its source and grade
What happened
Impact
Notes on gaps
Only the Microsoft Think/Do separation is mapped to a control; the Gemini content-script block and other controls are not mapped because the sources do not name them as controls in the list. A Claude for Chrome issue from another incident in the sources was excluded.
LR-2026-0729 · version 1 · published 2026-11-01 after automatic checks; not yet checked field by field by a person · JSON