Researchers: Malicious browser extensions can hijack AI assistants

Security researcher Gal Weizman of Forever Security published research named BragJack showing how a malicious browser extension, once installed, could abuse the deep privileges of browser-based AI assistants to carry out actions with zero additional clicks from the victim. The tests covered Gemini Live in Chrome, Perplexity Comet, Microsoft Edge Actions, Opera Neon and Anthropic's Claude in Chrome, relying on Chromium's declarativeNetRequest system to manipulate network requests. The demonstrations included access to local files, screenshots and browser profile information, turning on the camera and microphone, and, in Comet's case, instructing the agent to summarize the victim's recent emails and send them to another address. The findings produced more than $20,000 in bug bounties and two CVEs: CVE-2026-0628 for Google and CVE-2026-55945 for Microsoft. Google confirmed it released a Chrome patch so the method no longer works on the Gemini side panel, while Microsoft said updating Edge closes the hole; Perplexity, Opera and Anthropic had not responded by deadline. The research notes the attack first requires the malicious extension to be installed and does not report exploitation in the wild.