Researchers at Forever Security have shown that one ordinary browser extension could take control of the AI assistants built into five Chromium-based products: Gemini in Chrome, Perplexity Comet, Microsoft Edge’s Copilot, Opera Neon and the Claude in Chrome extension. The research is called BragJack. These are researcher demonstrations, not attacks seen in the wild, and each one requires the attacker’s extension to already be installed in the victim’s browser.
Hijacking the “brain”
Each product splits its assistant into two parts. A privileged “body” inside the browser can take screenshots, read files and use the camera. A “brain” runs on the vendor’s servers, and the body takes orders only from one trusted web page, such as gemini.google.com. “We didn’t even use prompt injection, because we discovered something worse,” Forever Security researcher Gal Weizman wrote. “All the vulnerabilities we discovered shared the same critical design flaw.”
The extension needed only two common permissions: content scripts, which ad blockers use to change web pages, and declarativeNetRequest, which can rewrite network traffic. With those, it could slip its own code into the trusted page and send commands to the agent as if it were the vendor. Weizman calls this “Prompt Forcing.”
Five products, different damage
According to The Hacker News’ breakdown, the extension could drive the AI agent to act for the attacker on Comet, Edge, Opera Neon and Claude in Chrome. On Chrome and Comet it could read files from the user’s computer, and on Chrome it could also turn on the camera and microphone. Comet was the worst case, with access to any file, browsing history, screenshots and the ability to act as the user. Forever Security reached it through a test address, testing.perplexity.com, that wasn’t locked down. Edge was the hardest. The researchers combined a takeover of a Microsoft marketing page with a race condition. Opera Neon was the easiest. Forever Security called the Claude in Chrome finding the mildest, since one extension was abusing another rather than a browser, and Anthropic rated it medium severity.
The Chrome flaw isn’t new. Weizman first described it in March as GlicJack. Google fixed it in Chrome 143.0.7499.192, and it’s tracked as CVE-2026-0628 (rated 8.8). The Edge issue, CVE-2026-55945 (rated 4.2), was fixed in Edge 150.0.4078.48 on July 2. The Comet, Opera Neon and Claude findings have no CVEs. The company said it earned about $20,000 in bounties, and its per-product figures add up to $20,500: $7,000 each from Google and Perplexity, $5,000 from Microsoft, $900 from Opera and $600 from Anthropic.
What to do
Update Chrome and Edge to at least the fixed versions. For Comet, Opera Neon and Claude in Chrome, Forever Security said each vendor paid a reward but gave no date for fixing the method it described, so keep those up to date too. Since every attack starts with a malicious extension, the most useful defense is extension hygiene. Review installed extensions, be wary of add-ons that ask to modify network requests, and for enterprises, allowlist extensions through policy. As browsers add agents that can read files and act for users, a low-privilege extension can become a path into a high-privilege part of the browser.
WebProNews is an iEntry Publication