What Happened
Security researcher Gal Weizman of Forever Security disclosed a new attack technique named BragJack, showing how a malicious browser extension seizes control of the AI assistant built directly into five major browsers: Google Chrome with Gemini, Microsoft Edge with Copilot, Opera Neon, Perplexity Comet, and Claude in Chrome. Unlike prompt injection, where an attacker hides instructions inside content an AI agent reads, BragJack exploits an architectural gap shared across all five products: each browser lets an untrusted extension cross the boundary meant to separate it from the privileged AI agent, so the extension sends prompts directly to the agent until it complies. In Chrome, Weizman used the gap to substitute JavaScript loaded by Gemini, gaining the ability to take screenshots, read local files, and activate the camera and microphone without a click from the user. Google, Microsoft, Opera, Anthropic, and Perplexity each confirmed a flaw in their own product and paid bug bounties. Google and Microsoft assigned CVE-2026-0628 and CVE-2026-55945 to the Chrome and Edge issues, and all five companies patched their browsers before publication. Read the original report from Dark Reading.
Why This Matters for Canadian Organizations
Weizman says any consumer running one of the five browsers with even a single extension installed faced exposure, putting hundreds of millions of users in the affected pool at the time of disclosure. Canadian enterprises are rolling out Copilot in Edge and Gemini in Chrome across Microsoft 365 and Google Workspace tenants at a pace outstripping most organizations’ extension governance policies, and BragJack shows how fast a routine extension install turns into a channel for data exfiltration or destructive actions on every site an employee stays logged into. The Canadian Centre for Cyber Security has flagged agentic AI tooling as an emerging risk area, and this disclosure gives this guidance a concrete example: the danger sits not in the AI model itself but in how browser vendors wall it off from the extensions running beside it.
What to Do
Security teams should keep every Chromium-based browser in the organization on its latest patched build and remove extensions not vetted through a formal approval process, particularly on machines with agentic AI features enabled. Where agentic browsers stay in use, export transcripts of the AI agent’s interactions with its provider and review them for signs an extension issued instructions the user never typed, since this style of attack bypasses most endpoint detection tools built for conventional malware.
