BragJack: A single browser extension is enough to give commands to AI assistants in five browsers

Gal Weizman of Forever Security hijacks Chrome, Edge, Opera Neon, Perplexity Comet, and Claude in Chrome built-in agents by abusing a network filtering API that the browser's privileged components consider trustworthy.

Researcher Gal Weizman of Forever Security has released a technique that he calls "quick forcing" and that he carefully distinguishes from the quick injection: where the latter slides instructions into a content that the model will read, BragJack gives the agent a complete prompt, mastering its content, its triggering moment and the subsequent revivals. The fault is therefore not in the judgment of the model but in the authorisation chain preceding its evaluation — no model-side safety filter can catch up with an insulation defect located upstream.

The technical lever is the API declarativeNetRequest Chromium, planned for extensions to filter network traffic. By using it, an extension can intercept queries, weaken security headers and inject code into the context where the browser's IA wizard runs. The necessary permissions do not come out of the ordinary: they correspond to what a classic advertising blocker demands. Once the extension is installed, no further interaction of the victim is required.

The demo was validated on Gemini Live in Chrome, Microsoft Edge, Perplexity Comet, Opera Neon and Claude for Chrome extension. Depending on the case, the attacker can have the agent read local files, capture screen copies and, on at least one browser, reach the camera and microphone controls through the agent himself. Two CVE identifiers were assigned — CVE-2026-0628 for Chrome and CVE-2026-55945 for a competitive situation in Edge — and Google like Microsoft have since corrected the faults attributed to them. The premiums paid by the five publishers range from $600 at Anthropic to $7,000 at Google, for a total of more than $20,000.