Browser extensions have long presented a security tradeoff: they add useful capabilities, but frequently receive permission to inspect pages, alter traffic and access browsing data. The BragJack research shows that this familiar risk becomes considerably more serious when a browser also contains an AI assistant capable of reading files, taking screenshots or acting on websites.
Security researcher Gal Weizman demonstrated the technique against five Chromium-based browsers or assistants, including Google Chrome's Gemini Live, Microsoft Edge, Perplexity Comet, Opera Neon and Claude in Chrome. The proof-of-concept required a malicious extension to be installed, but subsequent agent manipulation could occur without further interaction from the user. Google and Microsoft have resolved the assigned vulnerabilities. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/bragjack-attacks-hijack-ai-browser-agents-through-malicious-extensions/amp/))
Why Browser AI Changes the Risk
BragJack exploited the gap between an AI model that decides what to do and a privileged browser component that carries out the action. Chromium's declarativeNetRequest capability allowed the extension to alter headers, redirect resources or manipulate content trusted by the assistant.
Against agentic browsers, the consequences went beyond data visibility. The researcher demonstrated access to browser history, screenshots and local files, as well as the ability to issue instructions to an agent. In one example, an assistant was directed to summarize email content and send the result elsewhere. A separate race condition affected the division between thinking and action modes in Edge.
Defensive Priorities
- Remove browser extensions that are unnecessary, abandoned or unfamiliar.
- Restrict extensions requesting access to data on every website.
- Use enterprise browser policies to maintain approved extension lists.
- Keep browsers and integrated AI components fully updated.
- Monitor extension installations and permission changes as security events.
In my view, BragJack reveals that extension governance can no longer be treated as a minor browser-management task. As AI assistants gain authority to act for users, the browser becomes an execution environment for delegated decisions. Organizations should therefore apply least privilege not only to human accounts, but also to extensions, assistants and the communication paths connecting them.