The Mechanics of Prompt Forcing

Security researcher Gal Weizman of Forever Security has introduced a novel exploitation technique named BragJack. As detailed in his [full technical breakdown](https://forever.security/blog/bragjack-attack-hijacks-every-browser-agent), the attack targets the growing ecosystem of AI assistants integrated directly into modern web browsers. Unlike traditional prompt injection, which attempts to manipulate an AI's input via content it is currently processing, BragJack utilizes 'Prompt Forcing' to supply the agent with a complete sequence of instructions.

By gaining control through a malicious extension, an attacker can leverage the AI agent's privileged access to browser functions. These agents often possess the ability to read local files, access camera and microphone inputs, interact with websites, and capture screenshots. Because the AI is trusted by the browser's core architecture, the malicious extension essentially gains these elevated permissions by proxy.

Vulnerabilities Across Major Browsers

The proof-of-concept demonstration targeted five specific platforms: Google Chrome's Gemini Live, Perplexity Comet, Microsoft Edge, Opera Neon, and the Claude in Chrome extension. In his analysis, [Weizman describes](https://forever.security/blog/bragjack-hijacking-5-browsers-via-built-in-ai-assistants/) these systems as having a 'brain' (the AI model) and a 'body' (the privileged component that executes actions). The attack succeeds by exploiting the trust established between these two components.

For Google Chrome, the attack involved the declarativeNetRequest (DNR) functionality to intercept network traffic. By weakening security headers, the malicious extension executed code within the Gemini context. This specific vulnerability led to the assignment of [CVE-2026-0628](https://chromereleases.googleblog.com/2026/01/stable-channel-update-for-desktop.html) and earned a $7,000 bounty from Google.

Microsoft Edge required a different approach due to its 'Think' and 'Do' mode separation, which is designed to prevent simultaneous instruction processing and execution. Weizman identified a race condition that permitted the enforcement of prompts while momentarily disabling these restrictions. This vulnerability was addressed by Microsoft under [CVE-2026-55945](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55945).

Broader Implications for AI Security

The research highlights an evolving challenge for cybersecurity professionals as browsers continue to integrate advanced AI capabilities. While previous incidents, such as [ClaudeBleed](https://archive.li/Qguxu), demonstrated issues with trust origins in browser-based AI, BragJack shows that even standard extensions can become highly dangerous if they can manipulate web requests to communicate with privileged AI components.

Industry experts suggest that organizations must re-evaluate their defense strategies. Readers interested in learning how to defend against these emerging threats can [Build your security blueprint for AI-powered attacks](https://hubs.li/Q04x67m50) by attending upcoming digital security summits featuring industry leaders.

Recommendations for Users

To mitigate the risk of hijacking through malicious extensions, users should exercise strict hygiene regarding browser plugins. This includes keeping browsers fully updated to ensure that patches for vulnerabilities like those found by Weizman are applied immediately. Furthermore, users should periodically audit their installed extensions and remove any that are unrecognized or no longer in use.

Caution is particularly advised when granting permissions to extensions that request the ability to 'read and change all your data on all websites.' As security research [reported](https://www.manifold.security/blog/claude-for-chrome-extension-bypass) on related issues in the past, these broad permissions are exactly what attackers leverage to bridge the gap between simple script injection and full agent control.

Sources

• BleepingComputerBragJack attacks hijack AI browser agents through malicious extensions