"BragJack": One Browser Extension Can Drive the AI Assistants in Chrome, Comet, Edge, Opera Neon, and Claude in Chrome (CVE-2026-0628, CVE-2026-55945)

AI assistants built into or attached to Chromium browsers: Gemini Live in Chrome, Perplexity Comet, Microsoft Edge, Opera Neon, and Anthropic's Claude in Chrome extension

Gal Weizman of Forever Security published BragJack on September 16, 2026, a technique where a malicious extension using two common permissions, page modification and `declarativeNetRequest`, weakens security headers and redirects resources so that it can inject code into the trusted vendor pages the assistants run in. From there the extension can issue instructions directly to the AI, a step the researcher calls "Prompt Forcing," and have it act with the browser's existing privileges. Capabilities varied: in Chrome, local file reads, camera and microphone, profile data, and screenshots; in Comet, local files, driving the AI, profile and history leaks, and screenshots; in Edge, Opera Neon, and Claude in Chrome, control of the AI. Google fixed its variant, earlier named GlicJack, as CVE-2026-0628 (CVSS 8.8) in Chrome 143.0.7499.192 in January 2026, and Microsoft fixed CVE-2026-55945 (CVSS 4.2) in Edge 150.0.4078.48 on July 2, 2026. Comet, Opera Neon, and Claude received no CVEs; bounties totaled about $20,500, ranging from $600 to $7,000

Browser AI assistants trust the page they are hosted in, and extension permissions that were already powerful now reach an agent that can read files and act across sites. The extension never needs to exploit anything in the model