Think your browser’s built-in AI is a polite helper? Meet BragJack — a proof-of-concept trick that turns a misbehaving extension into a puppet master for those helpers. In plain English: if a shady extension is lurking in your browser, it can quietly boss around the browser’s AI, read things it shouldn’t, and even make the AI do stuff on your behalf.

What actually happened

Security researchers showed this technique against five Chromium-powered AI helpers — including Google’s Gemini Live, Perplexity Comet, Microsoft Edge’s assistant, Opera Neon, and a popular AI extension — and got vendors to fix the issues. The combined bug bounties totaled over $20,000, with individual payouts ranging from hundreds to a few thousand dollars, and the work produced a couple of CVEs.

The attack needs one basic ingredient: the victim already has a malicious extension installed. From there, the extension can operate silently and tell the browser’s AI to perform actions using its normal capabilities. That’s the terrifying bit: the attack doesn’t run weird executable malware — it persuades perfectly legitimate browser components to do the dirty work.

At the technical heart of this trick is the browser’s network rule feature that extensions can use to intercept and tweak requests. By abusing declarativeNetRequest (DNR), a single extension could change headers or redirect scripts so that code runs inside the AI assistant’s web context. Once the attacker’s script is running where the trusted assistant expects safe code, it can call on privileged browser pieces to access tabs, take screenshots, read local files, and in some setups, even ping the camera or mic.

Researchers called the method of handing full instructions to the assistant Prompt Forcing. Unlike sneaky prompt-injection that hides bad instructions inside content, Prompt Forcing hands the AI an entire directive and then watches it translate that into normal-looking browser actions. The end result looks like the browser doing exactly what it’s supposed to — except it’s following an attacker’s script.

Why this is worrying (and what to do about it)

Why does this matter? Because browser AI assistants now sit between web content and your system with stronger powers than a simple webpage. A compromised extension used to mean web content could be fiddled with; now it can be a stepping stone to components that access sensitive files or act on websites for you.

  • Keep your browser updated — vendors patched many of the vulnerabilities once they were reported.
  • Audit your extensions: uninstall anything you don’t recognize or haven’t used in ages.
  • Be suspicious of extensions asking for broad permissions like “read and change all data on all websites.” Those are powerful and often unnecessary.
  • Prefer official or well-reviewed extensions; treat unknown or obscure ones like candy left on the sidewalk.
  • Consider limiting extension use in browsers where sensitive work happens, or use profiles that separate day-to-day browsing from high-value tasks.

Bottom line: BragJack is a flashy reminder that the line between web content and privileged browser features is getting blurrier. Keep a tidy extension list, patch quickly, and remember that convenience sometimes comes with a tiny, invisible pickpocket.