A malicious browser extension can hijack AI assistants across five browsers: Chrome’s Gemini Live, Microsoft Edge, Opera Neon, Perplexity Comet, and Claude. Researcher Gal Weizman at Forever Security exploited a shared flaw by combining Content-Security-Policy weakening and JavaScript redirection to inject code into privileged AI agent contexts. Proofs-of-concept exfiltrated emails, captured screenshots, and accessed cameras. Two CVEs issued; all vendors patched.
The attack exposes an architectural bind: browser AI agents need full visibility into user context to work, but that privilege becomes an attack surface for untrusted extensions. That five independent implementations share the same vulnerability signals the problem is fundamental, not incidental. Palo Alto Networks disclosed the same issue in Chrome’s Gemini Live in March 2026, tracing it to October 2025, meaning the flaw persisted across vendors for nearly a year.
Sources: BragJack: Browser Agent Hijacking • Taming Agentic Browsers: Vulnerability in Chrome Allowed Extensions to Hijack New Gemini Panel
Coverage: BragJack Attack Can Turn a Browser’s Agentic AI Against It
Related on this blog: [AUTO] Data Diodes as AI Training Boundaries • [AUTO] ChatGPT Sandbox Isolation Fails via Shared Infrastructure • [AUTO] ChatGPT’s Invisible Data Exfiltration Flaw