Malicious extensions can steer Chromium AI assistants
Forever Security’s Gal Weizman said day 3 of BragJack turned a proof of concept into a formal vulnerability story: one malicious browser extension can hijack AI assistants in Google Chrome, Microsoft Edge, Opera Neon, Perplexity Comet, and Claude in Chrome, and the work earned two CVEs and more than $20,000 in bounties. The new identifiers are CVE-2026-0628 and CVE-2026-55945.
The trick is to abuse the browser’s own trust. A compromised extension can rewrite what the assistant sees or is allowed to act on, so the assistant follows prompts or content that did not come from the user in the way the browser intended. Because the extension sits in the shared browser profile, one add-on can steer several assistants that live in the same Chromium environment.
That leaves the durable exposure on the browser side of the AI stack, not inside one vendor’s model. If your users can install extensions in browser-hosted assistants, one extension compromise can become a shared control point across products, and fixing a single assistant does not remove the cross-product risk.
CVSS 8.8 HIGH: insufficient policy enforcement in WebView tag in Google Chrome prior to 143.0.7499.192 allowed an attacker who… EPSS 21% (97th percentile).
CVSS 4.2 MEDIUM: concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Edge… EPSS 0.2% (7th percentile). Microsoft patch: Release Notes.
BragJack, a proof-of-concept attack from Forever Security's Gal Weizman, hijacks the AI assistants in Chrome, Edge, Opera Neon, Perplexity Comet, and Claude in Chrome using one malicious extension.
A new type of attack hijacks AI assistants built directly into a browser to access sensitive information, execute malicious actions, and exfiltrate data.