One malicious browser extension could hijack the built-in AI agents in Chrome, Edge, Opera, Comet and Claude for Chrome -- researcher Gal Weizman calls the technique 'prompt forcing'

A single browser extension, already installed and already trusted, was enough to seize control of the built-in AI agent in five major browsers at once. Security researcher Gal Weizman of Forever Security published the technique -- named BragJack -- on Sept. 16, showing that Google Chrome's Gemini Live, Microsoft Edge's Copilot-powered Actions, Perplexity's Comet, Opera Neon and Anthropic's Claude for Chrome could each be forced to execute a complete, attacker-written prompt, with capabilities ranging up to camera and microphone access, depending on the browser, with zero further clicks from the victim.

Weizman calls the technique prompt forcing, and draws the distinction deliberately from prompt injection, the more familiar attack where hostile text hidden in a webpage tricks an AI agent that's already reading it. BragJack doesn't need the agent to be reading anything. The extension abuses `declarativeNetRequest`, a legitimate Chromium API that lets extensions rewrite or redirect web requests, to intercept the browser's own privileged communication channel with its AI agent and substitute the attacker's prompt for whatever the user actually typed -- or for nothing the user typed at all. Forever Security's own name for the underlying trick is "DiNneR Serving": weakening a page's Content-Security-Policy headers via the same API, then redirecting the scripts that load in the now-unprotected privileged context.

The specific hole differed browser to browser -- Gemini Live's flaw lived in how Chrome's WebView handled `gemini.google.com` traffic; Comet's in an internal domain, `testing.perplexity.com`, left listed among its own extension's trusted origins; Edge's in a race condition in the toggle that gates its agent's action-taking capability -- which is itself the more useful finding than any single bug: five independent engineering teams building the same category of feature converged on variations of the same class of mistake, trusting an extension's request more than they verified the extension's identity.

The individual bypasses read less like theoretical edge cases and more like the kind of thing a real attacker finds fast. Comet's file-access guard checked for a lowercase `file://` prefix; Weizman's proof-of-concept used `FiLe:///` instead, and the case-insensitive filesystem let it through. Edge sanitized the `@` character out of forced prompts to block a known injection pattern; writing "at" in its place carried the same semantic meaning to the underlying model while passing the filter untouched. Neither fix required new code discipline so much as a security team correctly guessing every string variant an attacker might try -- the kind of enumeration problem input sanitization reliably loses, because the defender has to block every variant and the attacker only needs one that isn't blocked yet.

Four of those five bounty figures aren't in dispute. The fifth is: Opera's $900 payout is the smallest on the list, and it comes attached to a claim about who actually found the bug first that Forever Security's own account doesn't concede.

The disclosure lands in the middle of a run of AI-agent security stories this year that keep landing on the same underlying point: shipping an agent fast has been outrunning the work of verifying what it's allowed to trust. Two weeks earlier, Plugin4Shell showed four different AI coding agents' commit-verification checks could be defeated the same way across vendors; before that, a PaperCut-focused attack campaign documented AI agents being actively used as the attacking tool rather than the target. BragJack is a third, distinct shape of the same underlying problem: not an agent being tricked by hostile content it reads, and not an agent being weaponized by an attacker who controls it deliberately, but an agent's own privileged channel being hijacked by something already sitting inside the browser with the user's own consent.

“This is not the same bug five times. It's the same design mistake made five separate times by five separate teams -- which says more about the pattern than about any one of them.” — Gal Weizman, Forever Security, on the BragJack findings

Google fixed its flaw in Chrome 143.0.7499.192/.193 and rated it High severity at 8.8; Microsoft's fix landed before Edge 150.0.4078.48, rated Medium at 4.2 because its variant required a harder-to-hit race condition rather than a direct request. Bounties ran from $600 for the Claude for Chrome report up to $7,000 apiece for the Chrome and Comet findings, with Edge's paying $5,000 -- combined vendor bounties across all five browsers came to roughly $20,000. Every vendor Forever Security named has now shipped a fix, and no outlet covering the research -- including Forever Security's own writeup -- has reported a confirmed case of the technique being used against a real victim outside the lab.

What BragJack actually demonstrates isn't that any one browser's AI feature was careless. It's that the extension permission model built for a browser that only renders pages doesn't automatically hold up once the browser can also act -- five vendors racing to ship agentic features on the same platform primitives independently produced variations of the same gap, and it took one outside researcher checking all five at once to make the pattern visible. Nothing in the vendors' own advisories addresses that structural question; each fixed its own instance.

All five of the features BragJack targets shipped within roughly the same year, as Chrome, Edge, Perplexity, Opera and Anthropic each raced to put an agent directly inside the browser rather than in a separate tab or app. That timing is the part worth sitting with: a security research class this consistent, appearing at once across five unrelated codebases, usually means the underlying primitive -- letting an installed extension talk to a privileged in-browser agent at all -- was standardized informally, by imitation, faster than any of the five teams individually stress-tested it.