Weizman's BragJack hijacks five Chromium AI assistants from a single installed extension

Extensions were blocked from touching the privileged chrome://glic component and from injecting scripts into Google's Gemini site, but declarativeNetRequest rules could still intercept the requests the embedded Gemini web app made ^[10]. Weizman weakened security headers and redirected a JavaScript resource ^[11]. His code then ran inside the Gemini context and spoke to Chrome's privileged AI component directly, skipping Gemini's normal request flow ^[11]. Weizman says that access could read local files, reach web content, take screenshots and potentially reach the browser's camera and microphone ^[12].

Comet's built-in agent extension trusted several Perplexity domains, one of them a testing domain that had not been given the protections applied to the primary perplexity.ai site ^[14]. Removing a redirect to that domain with a DNR rule was enough to load it and inject a content script able to talk to the agent ^[14].

Microsoft had already built a defence against this shape of abuse: it split the Edge agent into "Think" and "Do" modes so the agent could not take arbitrary instructions and actions at the same time ^[16]. Weizman found a race condition that briefly disables the restriction while a prompt is forced, then re-enables the action capability before the agent checks its state ^[17]. Microsoft assigned CVE-2026-55945 ^[17].

The five vendors paid more than $20,000, in a range from $600 to $7,000 ^[3]. Chrome's CVE-2026-0628 drew the top of that range at $7,000 ^[13], leaving more than $13,000 across the other four, better than $3,250 each ^[22]. Two CVEs came out of five vendor findings ^[3]. The report says Google and Microsoft have resolved the flaws they were assigned ^[6]; the other three findings carry no public identifier and no reported fix ^[23].

Claude in Chrome is the one target that is itself an extension ^[18], and it has history here. LayerX disclosed ClaudeBleed in April: the extension trusted the claude.ai origin instead of checking which script was actually driving it ^[20]. The author of the BleepingComputer account, who reported a related weakness while working at Manifold Security, says the extension ran its built-in AI workflows on synthetic clicks without verifying they came from a real user, and that the flagged code was still reproducible eight releases later ^[19].

Weizman calls the seizure technique Prompt Forcing and distinguishes it from conventional prompt injection ^[21]. In his writeup he describes these systems as having a "brain" and a "body", with the model deciding what should happen and a privileged browser component accessing tabs, reading content, taking screenshots and interacting with sites ^[7].

All five chains start with the extension already installed in the victim's browser ^[4], and after that nothing requires the user to click ^[5]. So the install decision settles the outcome. Where Chrome or Edge policy limits installs to an allowlist, the technique has no starting point; where users install what they like, an extension whose declared job is rewriting network requests ^[9] can end up reading local files, taking screenshots and issuing instructions to an agent that acts on the victim's behalf ^[5].