--- title: "BragJack: One Extension Hijacks the Built-In AI in Chrome, Comet, Edge, Opera Neon and Claude - CVE-2026-0628" description: "An ordinary browser extension can impersonate the vendor page that commands a built-in AI agent, then drive it. Five browsers, two CVEs, zero clicks." url: "https://anomity.ai/blog/bragjack-browser-extension-ai-assistant-hijack/" source: html --- On this page - The boundary that failed - Prompt-forcing, and why it is worse than injection - What the agent could reach - The part that does not have a patch - What to do - Frequently asked questions [← Back to blog](https://anomity.ai/blog/) - Home - Blog - BragJack: One Extension Hijacks the Built-In AI in Chrome, Comet, Edge, Opera Neon and Claude - CVE-2026-0628 ![Anomity robot illustrating BragJack: One Extension Hijacks the Built-In AI in Chrome, Comet, Edge, Opera Neon and Claude - CVE-2026-0628] Advisory High # BragJack: One Extension Hijacks the Built-In AI in Chrome, Comet, Edge, Opera Neon and Claude - CVE-2026-0628 Anomity Research Anomity Threat Research · Sep 18, 2026 · 5 min read Share: Copied Prompt Injection & Agent Hijacking · High · CVE-2026-0628, CVE-2026-55945 · Sep 18, 2026 Affected Google Chrome before 143.0.7499.192 (Gemini panel), Microsoft Edge before 150.0.4078.48, Perplexity Comet, Opera Neon, and the Claude in Chrome extension Gal Weizman of Forever Security disclosed BragJack, a proof of concept that hijacks the AI agents built into five browsers using nothing more exotic than an ordinary extension. It is not a prompt injection finding. It is a boundary failure: extensions were never supposed to be able to command the browser's privileged AI, and in five independently built products they could. The Chrome case came first, disclosed publicly in March 2026 as GlicJack and fixed in January 2026 in version 143.0.7499.192, carrying CVE-2026-0628 at CVSS 8.8. The same idea then reached Perplexity Comet, Microsoft Edge, Opera Neon and the Claude in Chrome extension. Only Edge produced a second identifier, CVE-2026-55945 at CVSS 4.2, fixed on 2 July 2026 in 150.0.4078.48. ## The boundary that failed A browser AI agent is, functionally, a body without a mouth of its own. It performs actions, and it takes instructions from exactly one place: a trusted vendor page. That design is deliberate and reasonable. It means a random website cannot tell Gemini to read your files, because a random website is not google.com. Product Page trusted to command the agent How BragJack got inside it Chrome, Gemini panel google.com Network header manipulation so a trusted-domain response carried attacker code Perplexity Comet perplexity.ai, with testing.perplexity.com as backup Redirect to the backup testing domain, then injection there Microsoft Edge A Microsoft marketing page holding special permission An unguarded privileged page plus a timing race between agent modes Opera Neon opera.com declarativeNetRequest combined with direct content-script injection Claude in Chrome Anthropic's domain An unguarded page reached by one extension abusing another The two permissions required are the ones nobody blocks. Content scripts let an extension inject JavaScript into websites, which is how every ad blocker, password manager and reader-mode tool works. `declarativeNetRequest` lets an extension intercept and modify network traffic, which is how content blocking is implemented under Manifest V3. Requesting both is unremarkable. Holding both, on these browsers, was enough to impersonate the vendor. > The body only takes orders from one trusted web page. An extension is not supposed to be able to command that body. ## Prompt-forcing, and why it is worse than injection Weizman draws a deliberate distinction. In prompt injection, an attacker hides instructions in content the agent reads and hopes they are followed. Detection is possible because there is something anomalous in the data. In prompt-forcing, the attacker owns the command channel: the entire prompt is written and sent through the interface the agent was built to obey, the response is read, and follow-ups are issued based on it. That makes the attack interactive rather than one-shot, chainable across steps, and invisible to the classifier layers that vendors have spent the past two years building. It also requires zero clicks. The user installs a plausible extension and the rest happens without interaction. This is a meaningfully different threat class from the DOM-borne injection covered in [browser AI security risks and controls](https://anomity.ai/blog/browser-ai-security-risks-and-controls/), and it defeats defences designed for that class by not being that class. ## What the agent could reach On Chrome, the researchers demonstrated local file reading, screenshots, camera and microphone access, and leakage of profile data and browsing history. Comet was comparable, with file access, full browser control and profile and history leakage. Edge and Opera Neon gave up control of the AI agent, which in an agentic browser is not a minor outcome: the agent can navigate, read authenticated pages and submit forms as the signed-in user. Claude in Chrome was the mildest case, an extension abusing another extension rather than a privileged browser component, but agent control still reaches whatever the session reaches, including email. Put in enterprise terms: a compromised agent in an authenticated browser has the user's access to every web application they are signed into, with no new credential required and no anomalous login to detect. The identity is correct, the session is legitimate, and the instructions are not the user's. This is the containment problem described in [securing computer-use and browser agents](https://anomity.ai/blog/securing-computer-use-and-browser-agents/), arriving through the extension layer rather than through the page. ## The part that does not have a patch Chrome and Edge shipped fixes with version numbers you can enforce. Comet, Opera Neon and Claude in Chrome paid bounties and shipped changes without CVEs, which means there is no identifier to feed into vulnerability management and no fixed version to compare against. If your process is driven by CVE ingestion, three of these five findings never reach it. There is also a structural point worth sitting with. Five products, built by five independent teams, made the same architectural choice and inherited the same flaw. That is not five mistakes. It is a pattern in how browser AI agents are currently designed: privilege is granted to an origin, and origins are exactly what extensions are able to manipulate. Expect more of this until the trust boundary moves somewhere an extension cannot reach. ## What to do - Enforce minimum browser versions : Chrome 143.0.7499.192 or later, Edge 150.0.4078.48 or later. These are the only two findings with a version you can hold people to. - Find the agentic browsers. Comet and Opera Neon are usually installed by individuals, not by IT, so they rarely appear in a software catalogue. Neither has a CVE to trigger a review. - Inventory extensions by permission, not by name. The signal is any extension holding declarativeNetRequest together with broad host permissions. That pair is the precondition, and it is present in far more extensions than most teams expect. The most common AI browser extensions is a useful starting list. - Treat browser AI agents as a policy decision. The agent inherits the user's authenticated sessions. Whether that is acceptable is a decision to make deliberately rather than by not noticing. - Watch for the account boundary. An agentic browser signed into a personal account that then acts on corporate applications is a different risk profile from a managed corporate profile, and the distinction is only visible from inside the browser. As of 16 September 2026 none of the five techniques appears in CISA's Known Exploited Vulnerabilities catalog, and there is no public evidence of exploitation in the wild. That is the good news, and it is the usual shape of it: the research is public, the pattern is now understood, and three of the five products have no version number you can point at. The gap between disclosure and adversary adoption for this class has historically been short, and [shadow AI detection techniques](https://anomity.ai/blog/shadow-ai-detection-techniques-best-practices/) is the right place to start if you cannot currently answer which browsers and extensions are running across the fleet. Share: Copied ## Frequently asked questions Am I affected by BragJack? You are exposed if anyone in your fleet runs a browser with a built-in AI agent and permits extensions. Specifically: Chrome with the Gemini panel before version 143.0.7499.192, Microsoft Edge before 150.0.4078.48, or any current build of Perplexity Comet, Opera Neon, or Chrome with the Claude in Chrome extension installed, since those three received no CVE and no version-pinned fix you can check against. The trigger is not visiting a malicious site. It is having an extension installed that holds content-script and declarativeNetRequest permissions, which describes a large share of the extensions people already run. The practical first step is knowing which browsers and which extensions exist across the fleet, which most organisations cannot answer today. How does the attack actually work? Browser AI agents are built so that only one trusted page can issue them commands. Chrome's Gemini panel trusts google.com, Comet trusts perplexity.ai with testing.perplexity.com as a backup, Opera Neon trusts opera.com, Claude in Chrome trusts Anthropic's domain, and Edge grants the privilege to a Microsoft marketing page. That boundary is enforced by page origin. An extension with content-script permission can inject JavaScript into pages, and an extension with declarativeNetRequest can alter the network traffic that produces those pages. Combine the two and the extension can modify headers so a trusted-domain response carries attacker code, block the redirect that would take the browser to a backup domain, or simply inject into an unguarded vendor page. The injected code then runs with the origin the agent trusts, and issues commands the agent treats as legitimate. How is prompt-forcing different from prompt injection? Prompt injection smuggles instructions into data the model reads and hopes the model follows them. It is probabilistic, and defences are mostly classifiers that try to spot the smuggling. Prompt-forcing skips that entirely. The attacker holds the privileged channel the agent was built to obey, so it writes and sends the whole prompt directly, reads the result, and sends follow-ups based on what came back. There is nothing to detect in the page content because the instruction is not hidden in content, it arrives through the command interface. This is why the fix is an origin and permission boundary rather than a better classifier, and why it matters that the flaw was architectural and shared across five independently built products. What could an attacker actually do? It varied by product. On Chrome the researchers reached local file reading, screenshots, camera and microphone access, profile data and browsing history. Comet was comparable and in some respects the most severe, with file access, full browser control, and profile and history leakage. Edge and Opera Neon yielded control of the AI agent itself, which in an agentic browser means the ability to navigate, read authenticated pages and submit forms as the signed-in user. Claude in Chrome was the least severe case because it is an extension abusing another extension rather than a privileged browser component, though agent control still means access to whatever the user's session can reach, including email. Why did three of the five products get no CVE? CVE assignment follows vendor policy rather than severity. Google issued CVE-2026-0628 at CVSS 8.8 and Microsoft issued CVE-2026-55945 at CVSS 4.2. Perplexity, Opera and Anthropic paid bounties but did not assign identifiers. The operational consequence matters more than the scoring debate: for Comet, Opera Neon and Claude in Chrome there is no CVE to feed into vulnerability management, no fixed-version number to compare against, and no signal that reaches a patch compliance dashboard. If your process only tracks what has an identifier, three of these five findings are invisible to it. What should we do about it? Four things, in order. Enforce minimum versions for Chrome and Edge, since those have fixes. Inventory which browsers with built-in AI agents exist in the fleet, because Comet and Opera Neon are frequently installed by individuals rather than by IT. Inventory browser extensions and specifically flag any holding declarativeNetRequest alongside broad host permissions, which is the exact combination BragJack requires. Then decide policy on agentic browsers deliberately rather than by default, because the agent in these products can reach any authenticated session the user has open, and no CVE fix changes that. How does Anomity help with this? The browser sensor is built for precisely this gap. It inventories browser extensions across the fleet, including the permissions each one holds, so the declarativeNetRequest plus host-permission combination that BragJack depends on becomes a query rather than an investigation. It identifies which AI web services and agentic browsers are in use across 311 tracked services, and whether the signed-in account is corporate or personal. The endpoint sensor covers the installed side, including browser builds and version, so the Chrome and Edge minimum-version questions are answerable in one place. Enforcement then applies across 180 rules and nine guards, so an unapproved agentic browser can be surfaced, restricted or blocked without waiting for a CVE to exist. ## Related [Advisory High ### Cryptographic Context Injection: Encrypted Prompt Injection Against Grok and Gemini Adversa AI's Cryptographic Context Injection hides prompt injection in AES-256-GCM ciphertext; reported still reproducible against Grok on 19 August 2026. Anomity Research · Aug 29, 2026 · Cryptographic Context Injection (Adversa AI, 20 August 2026; Rony Utevsky). No CVE identifier reported as of 20 August 2026.](https://anomity.ai/blog/cryptographic-context-injection-grok-gemini-encrypted-prompt-injection/) [Advisory High ### GhostSplice: Splitting One Refused Instruction Across Three MCP Channels GhostSplice splits a refused exfiltration request across three MCP channels. No fragment is malicious. Average model compliance rose from 42% to 82%. Anomity Research · Aug 17, 2026 · GhostSplice / Cross-Channel Trust Fragmentation (ASSET Research Group, August 2026; CVE identifiers pending coordinated disclosure)](https://anomity.ai/blog/ghostsplice-cross-channel-mcp-instruction-splitting/) [Advisory Critical ### GhostJacking: Hijacking AI Agents Through Authorized Actions (DEFCON 34) GhostJacking hijacks AI agents using only actions they were authorized to take. Tenet reports a 90% success rate against Claude Code and zero detections. Anomity Research · Aug 10, 2026 · GhostJacking (DEFCON 34, August 9 2026; no CVE assigned)](https://anomity.ai/blog/ghostjacking-agentic-kill-chain-authorized-actions/) ## Structured data ```json { "@context": "https://schema.org", "@type": "TechArticle", "headline": "BragJack: One Extension Hijacks the Built-In AI in Chrome, Comet, Edge, Opera Neon and Claude - CVE-2026-0628", "description": "An ordinary browser extension can impersonate the vendor page that commands a built-in AI agent, then drive it. Five browsers, two CVEs, zero clicks.", "datePublished": "2026-09-18", "dateModified": "2026-09-18", "author": { "@type": "Organization", "name": "Anomity", "url": "https://anomity.ai/", "sameAs": [ "https://www.linkedin.com/company/anomity", "https://github.com/Anomity-ai", "https://www.wikidata.org/wiki/Q140763940" ] }, "publisher": { "@type": "Organization", "name": "Anomity", "url": "https://anomity.ai/", "sameAs": [ "https://www.linkedin.com/company/anomity", "https://github.com/Anomity-ai", "https://www.wikidata.org/wiki/Q140763940" ], "logo": { "@type": "ImageObject", "url": "https://anomity.ai/icon-512.png" } }, "mainEntityOfPage": { "@type": "WebPage", "@id": "https://anomity.ai/blog/bragjack-browser-extension-ai-assistant-hijack/" }, "image": { "@type": "ImageObject", "url": "https://anomity.ai/assets/blog/covers/prompt-injection.jpg", "width": 1200, "height": 630 }, "articleSection": "Prompt Injection & Agent Hijacking", "url": "https://anomity.ai/blog/bragjack-browser-extension-ai-assistant-hijack/", "keywords": "BragJack browser AI hijack, CVE-2026-0628, CVE-2026-55945, BragJack, CVE-2026-0628, CVE-2026-55945, Browser Extensions, Perplexity Comet, Claude in Chrome, Opera Neon, Agent Hijacking, declarativeNetRequest" } ``` ```json { "@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "name": "Am I affected by BragJack?", "acceptedAnswer": { "@type": "Answer", "text": "You are exposed if anyone in your fleet runs a browser with a built-in AI agent and permits extensions. Specifically: Chrome with the Gemini panel before version 143.0.7499.192, Microsoft Edge before 150.0.4078.48, or any current build of Perplexity Comet, Opera Neon, or Chrome with the Claude in Chrome extension installed, since those three received no CVE and no version-pinned fix you can check against. The trigger is not visiting a malicious site. It is having an extension installed that holds content-script and declarativeNetRequest permissions, which describes a large share of the extensions people already run. The practical first step is knowing which browsers and which extensions exist across the fleet, which most organisations cannot answer today." } }, { "@type": "Question", "name": "How does the attack actually work?", "acceptedAnswer": { "@type": "Answer", "text": "Browser AI agents are built so that only one trusted page can issue them commands. Chrome's Gemini panel trusts google.com, Comet trusts perplexity.ai with testing.perplexity.com as a backup, Opera Neon trusts opera.com, Claude in Chrome trusts Anthropic's domain, and Edge grants the privilege to a Microsoft marketing page. That boundary is enforced by page origin. An extension with content-script permission can inject JavaScript into pages, and an extension with declarativeNetRequest can alter the network traffic that produces those pages. Combine the two and the extension can modify headers so a trusted-domain response carries attacker code, block the redirect that would take the browser to a backup domain, or simply inject into an unguarded vendor page. The injected code then runs with the origin the agent trusts, and issues commands the agent treats as legitimate." } }, { "@type": "Question", "name": "How is prompt-forcing different from prompt injection?", "acceptedAnswer": { "@type": "Answer", "text": "Prompt injection smuggles instructions into data the model reads and hopes the model follows them. It is probabilistic, and defences are mostly classifiers that try to spot the smuggling. Prompt-forcing skips that entirely. The attacker holds the privileged channel the agent was built to obey, so it writes and sends the whole prompt directly, reads the result, and sends follow-ups based on what came back. There is nothing to detect in the page content because the instruction is not hidden in content, it arrives through the command interface. This is why the fix is an origin and permission boundary rather than a better classifier, and why it matters that the flaw was architectural and shared across five independently built products." } }, { "@type": "Question", "name": "What could an attacker actually do?", "acceptedAnswer": { "@type": "Answer", "text": "It varied by product. On Chrome the researchers reached local file reading, screenshots, camera and microphone access, profile data and browsing history. Comet was comparable and in some respects the most severe, with file access, full browser control, and profile and history leakage. Edge and Opera Neon yielded control of the AI agent itself, which in an agentic browser means the ability to navigate, read authenticated pages and submit forms as the signed-in user. Claude in Chrome was the least severe case because it is an extension abusing another extension rather than a privileged browser component, though agent control still means access to whatever the user's session can reach, including email." } }, { "@type": "Question", "name": "Why did three of the five products get no CVE?", "acceptedAnswer": { "@type": "Answer", "text": "CVE assignment follows vendor policy rather than severity. Google issued CVE-2026-0628 at CVSS 8.8 and Microsoft issued CVE-2026-55945 at CVSS 4.2. Perplexity, Opera and Anthropic paid bounties but did not assign identifiers. The operational consequence matters more than the scoring debate: for Comet, Opera Neon and Claude in Chrome there is no CVE to feed into vulnerability management, no fixed-version number to compare against, and no signal that reaches a patch compliance dashboard. If your process only tracks what has an identifier, three of these five findings are invisible to it." } }, { "@type": "Question", "name": "What should we do about it?", "acceptedAnswer": { "@type": "Answer", "text": "Four things, in order. Enforce minimum versions for Chrome and Edge, since those have fixes. Inventory which browsers with built-in AI agents exist in the fleet, because Comet and Opera Neon are frequently installed by individuals rather than by IT. Inventory browser extensions and specifically flag any holding declarativeNetRequest alongside broad host permissions, which is the exact combination BragJack requires. Then decide policy on agentic browsers deliberately rather than by default, because the agent in these products can reach any authenticated session the user has open, and no CVE fix changes that." } }, { "@type": "Question", "name": "How does Anomity help with this?", "acceptedAnswer": { "@type": "Answer", "text": "The browser sensor is built for precisely this gap. It inventories browser extensions across the fleet, including the permissions each one holds, so the declarativeNetRequest plus host-permission combination that BragJack depends on becomes a query rather than an investigation. It identifies which AI web services and agentic browsers are in use across 311 tracked services, and whether the signed-in account is corporate or personal. The endpoint sensor covers the installed side, including browser builds and version, so the Chrome and Edge minimum-version questions are answerable in one place. Enforcement then applies across 180 rules and nine guards, so an unapproved agentic browser can be surfaced, restricted or blocked without waiting for a CVE to exist." } } ] } ``` ```json { "@context": "https://schema.org", "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://anomity.ai/" }, { "@type": "ListItem", "position": 2, "name": "Blog", "item": "https://anomity.ai/blog/" }, { "@type": "ListItem", "position": 3, "name": "BragJack: One Extension Hijacks the Built-In AI in Chrome, Comet, Edge, Opera Neon and Claude - CVE-2026-0628", "item": "https://anomity.ai/blog/bragjack-browser-extension-ai-assistant-hijack/" } ] } ```