CVE-2026-0628

Security researcher Gal Weizman discovered a new attack technique called BragJack that hijacks AI browser agents through malicious browser extensions. The proof-of-concept targets AI assistants in Chromium-based browsers including Google Chrome's Gemini Live, Perplexity Comet, Microsoft Edge, Opera Neon, and Claude in Chrome by exploiting trust relationships and browser extension capabilities. The attacks use declarativeNetRequest (DNR) rules to manipulate trusted components, enabling unauthorized access to sensitive data and control over AI agents without user interaction. The technique, dubbed 'Prompt Forcing,' allows attackers to send full prompts and instructions to the AI agent, leveraging its legitimate privileges to perform malicious actions.

Security researchers at Forever Security demonstrated a method to hijack AI assistants in multiple Chromium-based browsers and extensions by exploiting browser extension permissions to intercept trusted communication channels. The technique leverages two common extension permissions—content modification and network request manipulation—to inject malicious code into trusted AI service pages, enabling unauthorized access to sensitive capabilities such as file reading, screenshot capture, and AI agent control. While no active exploitation in the wild has been observed, the research highlights critical design flaws in how AI agents are integrated into browsers, with CVE-2026-0628 (Chrome) and CVE-2026-55945 (Edge) officially recognized and patched, while similar issues in Comet, Opera Neon, and Claude in Chrome remain less formally addressed.