Overview
A newly disclosed attack technique called BragJack demonstrates that a single malicious browser extension can silently hijack AI assistants integrated into popular Chromium-based browsers — without any user interaction. Disclosed by security researcher Gal Weizman of Forever Security, the proof-of-concept was validated against five targets: Google Chrome’s Gemini Live, Perplexity Comet, Microsoft Edge, Opera Neon, and Anthropic’s Claude running in Chrome. Two CVEs were issued, and vendors paid over $20,000 in bug bounties collectively. Both Google and Microsoft have patched their respective flaws.
The research highlights a structural tension in modern browser design: as AI agents are granted deeper browser-level privileges to be useful, the attack surface for extension-based compromise expands proportionally.
Technical Analysis
Weizman frames the AI browser agent architecture as having two components — a “brain” (the AI model that processes instructions) and a “body” (a privileged browser component that executes actions like reading tabs, taking screenshots, or accessing local files).
The attack vector is Chromium’s declarativeNetRequest (DNR) API, a legitimate extension capability that allows modification of network request handling, including response header manipulation and JavaScript resource redirection.
In the Chrome/Gemini Live case specifically:
- Extensions are blocked from directly accessing the privileged
chrome://gliccomponent or injecting scripts into Google’s Gemini site. - However, DNR rules can still intercept network requests made by the embedded Gemini web app.
- By weakening Content Security Policy headers and redirecting a JavaScript resource, Weizman executed arbitrary code inside the Gemini context.
- This code could communicate directly with Chrome’s privileged AI component, bypassing Gemini’s normal request flow.
The resulting access could read local files and perform actions on behalf of the user — all initiated silently from an already-installed extension.
Framework Mapping
MITRE ATLAS:
- AML.T0081 (Modify AI Agent Configuration) and AML.T0110 (AI Agent Tool Poisoning) apply as the extension manipulates the trust boundary of the AI agent’s execution environment.
- AML.T0086 (Exfiltration via AI Agent Tool Invocation) reflects the ability to leverage the agent’s browser privileges to read and exfiltrate local files.
- AML.T0067 (LLM Trusted Output Components Manipulation) captures the core mechanism: subverting a component the AI model trusts to relay instructions.
OWASP LLM Top 10:
- LLM07 (Insecure Plugin Design) is the primary match — extensions function as de facto plugins with insufficient isolation from privileged AI contexts.
- LLM08 (Excessive Agency) applies given the AI agent’s broad browser-level permissions amplify what an attacker can achieve post-compromise.
Impact Assessment
Any user running a Chromium-based browser with an integrated AI assistant and a malicious extension installed is potentially affected. The attack requires no user interaction post-installation, making it highly practical in enterprise environments where extension governance is weak. The scope of damage — file access, screen capture, authenticated web actions — reflects the broad privileges modern AI browser agents are granted by design.
Mitigation & Recommendations
- Patch immediately: Apply Google and Microsoft’s fixes for the assigned CVEs. Check Perplexity, Opera, and Anthropic advisories for their respective remediations.
- Audit extensions: Remove all untrusted or unrecognised extensions from browsers that host AI agents.
- Enforce extension allowlisting: Use enterprise browser management policies (e.g., Chrome Browser Cloud Management) to restrict which extensions can be installed.
- Limit AI agent privileges: Where configurable, reduce the scope of permissions granted to AI browser components — apply least-privilege principles.
- Monitor network traffic: Anomalous redirects of JavaScript resources within browser sessions may indicate DNR-based manipulation.