A new attack method called "BragJack" enables malicious browser extensions to seize trusted communication channels used by AI assistants in Chrome, Edge, Opera Neon, Comet, and Claude in Chrome. Unlike bypassing model guardrails or hiding instructions inside web content, this proof-of-concept attack directly supplies commands to privileged browser components, turning an assistant into a tool for theft and unauthorized actions. Forever Security researcher Gal Weizman demonstrated the technique across all five Chromium-based environments using one extension with browser-specific rules.
The researchers replaced a legitimate JavaScript resource and executed code within Gemini's trusted context, gaining the ability to read local files, capture screenshots, expose profile information, and activate the camera or microphone.
The extension removed that domain’s redirect header, injected a content script, and directly communicated with the agent, enabling browsing-history access, screenshots, profile leakage, local-file reading, and autonomous activity on authenticated websites. A malicious extension needed to be installed first, so "zero-click" exploitation follows installation, not an internet-based compromise without prior user interaction. Enterprise defenders should enforce extension allowlists, restrict broad host and DNR permissions, scrutinize debugger access, and monitor unusual browser-driven access to files, microphones, cameras, email, and authenticated applications.
BragJack's key takeaway is that AI agents require strict origin validation, least privilege, isolated command channels, explicit confirmation for sensitive actions, and audit logs that security teams can scrutinize.
