Executive Summary
In September 2026, security researcher Gal Weizman disclosed BragJack, a novel attack technique that hijacks AI assistants built into popular browsers using malicious extensions. The attack exploited vulnerabilities in five Chromium-based browsers including Google Chrome's Gemini Live, Microsoft Edge, Opera Neon, Perplexity Comet, and Anthropic's Claude extension. By leveraging Chrome's declarativeNetRequest functionality, attackers could manipulate web traffic to privileged browser components, enabling unauthorized access to local files, browsing history, screenshots, and the ability to control AI agents to perform actions on behalf of victims. The research earned over $20,000 in bug bounties and resulted in two CVEs being assigned.
This incident highlights the emerging security risks as AI agents become deeply integrated into browsers with elevated privileges, creating new attack vectors that traditional endpoint defenses may not adequately address.
Why This Matters Now
BragJack represents a critical evolution in browser-based attacks, exploiting the trust boundaries between AI agents and browser extensions as organizations rapidly adopt AI-powered browsing tools without fully understanding the expanded attack surface.
Attack Path Analysis
BragJack attacks begin with malicious browser extension installation, escalate through AI agent privilege abuse via DNR manipulation, enable lateral movement across browser contexts, establish command and control through prompt forcing techniques, exfiltrate sensitive data including emails and browsing history, and ultimately impact user privacy and organizational security through unauthorized AI-driven actions.
Kill Chain Progression
This analysis maps confirmed threat intelligence to the full cloud kill chain to show where defensive gaps would emerge as an attack progresses.
Initial Compromise
Description
Malicious browser extension installed with broad permissions, gaining access to declarativeNetRequest (DNR) functionality to manipulate network traffic and trusted browser components
Related CVEs
CVE-2026-0628
CVSS 8.8A privilege escalation vulnerability in Chrome's Gemini Live AI assistant allows malicious browser extensions to bypass security restrictions and execute code in privileged contexts.
Affected Products:
Google Chrome Browser – < 131.0.6778.108
Exploit Status:
proof of conceptCVE-2026-55945
CVSS 4.2A race condition vulnerability in Microsoft Edge AI agent allows malicious extensions to bypass Think/Do mode restrictions and force the agent to execute arbitrary instructions.
Affected Products:
Microsoft Edge Browser – < 131.0.2903.112
Exploit Status:
proof of concept
MITRE ATT&CK® Techniques
Browser Extensions
Process Hollowing
LLMNR/NBT-NS Poisoning and SMB Relay
Browser Session Hijacking
Screen Capture
Data from Local System
Data from Information Repositories
Trusted Relationship
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – Software Security Framework
Control ID: 6.4.2
NYDFS 23 NYCRR 500 – Penetration Testing
Control ID: 500.15
DORA – ICT Risk Management Framework
Control ID: Article 8
CISA ZTMM 2.0 – Application Layer Protection
Control ID: Application Security
NIS2 Directive – Cybersecurity Risk Management Measures
Control ID: Article 21.2(a)
ISO 27001 – Secure Development Policy
Control ID: A.14.2.1
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Financial Services
BragJack attacks targeting AI browser agents pose critical risks to online banking platforms, potentially enabling unauthorized access to customer accounts and sensitive financial data through compromised extensions.
Computer Software/Engineering
Software companies face significant exposure as AI-integrated development tools and browser-based platforms become vulnerable to prompt forcing attacks, compromising intellectual property and development environments.
Health Care / Life Sciences
Healthcare organizations using AI-powered browser tools risk HIPAA violations through unauthorized access to patient records, with malicious extensions potentially hijacking privileged medical information systems.
Computer/Network Security
Cybersecurity firms must address new attack vectors targeting AI browser agents, as traditional endpoint defenses fail against prompt forcing techniques using legitimate software for malicious actions.
Sources
- BragJack attacks hijack AI browser agents through malicious extensionshttps://www.bleepingcomputer.com/news/security/bragjack-attacks-hijack-ai-browser-agents-through-malicious-extensions/Verified
- BragJack: Hijacking 5 Browsers via Built-in AI Assistantshttps://forever.security/blog/bragjack-hijacking-5-browsers-via-built-in-ai-assistants/Verified
- Chrome Stable Channel Update for Desktophttps://chromereleases.googleblog.com/2026/01/stable-channel-update-for-desktop.htmlVerified
- Microsoft Security Response Center - CVE-2026-55945https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55945Verified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.
Aviatrix Zero Trust CNSF would likely constrain BragJack's cross-context lateral movement and AI agent abuse by enforcing segmented browser-to-cloud communications and restricting unauthorized egress paths. The attack's blast radius would be reduced through workload isolation and controlled east-west traffic enforcement.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: Zero Trust fabric visibility may have constrained the extension's ability to establish unauthorized connections to cloud resources and reduced its access scope to backend services through policy enforcement
Control: Zero Trust Segmentation
Mitigation: Segmentation policies would likely constrain the extension's ability to escalate privileges across different AI agent contexts and reduce lateral access to privileged browser components through workload isolation
Control: East-West Traffic Security
Mitigation: East-west traffic controls would likely limit the attacker's ability to move between different browser contexts and AI agents, constraining their reach across testing domains and reducing injection capabilities
Control: Multicloud Visibility & Control
Mitigation: Visibility controls would likely detect and constrain anomalous AI agent communications, reducing the attacker's ability to maintain persistent command channels and limiting their control over agent capabilities
Control: Egress Security & Policy Enforcement
Mitigation: Egress controls would likely constrain the AI agents' ability to transmit sensitive data to unauthorized destinations, reducing the scope of data exfiltration through policy-based traffic filtering
Residual impact would likely be limited to local browser context and user-scoped resources, with reduced organizational exposure due to constrained lateral movement and controlled egress policies
Impact at a Glance
Affected Business Functions
- Web Browser Security
- AI Assistant Services
- Enterprise Browser Management
- Data Privacy Controls
Estimated downtime: N/A
Estimated loss: N/A
Potential exposure of browsing history, local files, screenshots, email content, and camera/microphone access through compromised AI browser agents. Sensitive corporate data accessible through browser-based workflows at risk.
Recommended Actions
Key Takeaways & Next Steps
- • Implement Cloud Native Security Fabric (CNSF) with inline enforcement to detect and block malicious AI agent interactions and prompt forcing attempts in real-time
- • Deploy Egress Security & Policy Enforcement controls to prevent unauthorized data exfiltration from AI agents and enforce FQDN filtering for agent communications
- • Enable Multicloud Visibility & Control to monitor anomalous AI agent interactions, repeated malformed requests, and suspicious automation patterns across browser environments
- • Establish Zero Trust Segmentation with identity-based policies to limit AI agent privileges and enforce least-privilege access to sensitive resources
- • Activate Threat Detection & Anomaly Response capabilities to baseline normal AI agent behavior and alert on deviations indicating potential hijacking or abuse
