Security researchers have shown how malicious extensions can take control of AI assistants in several browsers, directing them to collect emails or exposing files stored on a user’s computer.
The BragJack research, published September 16 by Forever Security’s Gal Weizman, covers Gemini Live in Chrome, Perplexity Comet, Microsoft Edge Actions, Opera Neon and Anthropic’s Claude in Chrome extension. The attacks exploit weaknesses in the software that connects the assistants to browser functions.
Each attack requires a malicious extension to be installed with the necessary permissions. The researchers’ description of attacks requiring no clicks applies after installation. Some demonstrations also required permission to use browser debugging tools, which let the extension simulate a user’s click.
In Comet, the browser’s AI agent trusted a testing website that lacked the protections applied to Perplexity’s main site. The researchers used their extension to stop that page redirecting visitors elsewhere, then sent commands through it. They could retrieve browsing history, take screenshots and access local files.
The researchers also instructed agents to collect email content and send it to another address. Weizman calls this “prompt forcing”: an attacker submits a complete instruction through an interface the assistant treats as trusted. The attacker can choose when to send it and follow up with further requests.
The Chrome attack targeted the software behind the Gemini panel. By interfering with the web content loaded inside it, the extension gained access to browser commands. Forever Security says this allowed access to local files, screenshots, browser-profile information, and the camera and microphone.
Google had already fixed that vulnerability in January. Its January 6 release identifies CVE-2026-0628 as a high-severity flaw in the rules governing embedded web content, reported by Weizman in November 2025. The fix appeared in Chrome 143.0.7499.192 for Linux and 143.0.7499.192/.193 for Windows and Mac. The new report incorporates that earlier finding.
The Edge demonstration used a promotional webpage that could insert text into the assistant’s input box. The researcher then exploited a timing flaw to have the agent act on the instruction. Opera’s website provided another route for an extension to send commands to its assistant.
Claude in Chrome was reached through an onboarding page that could send prompts to its side panel. This involved one extension targeting another, rather than gaining control of a browser’s built-in assistant. The capabilities demonstrated varied by product: direct local-file access was documented for Chrome and Comet.
Forever Security says Google, Microsoft, Perplexity, Opera and Anthropic paid bounties for the findings. The Edge issue is listed as CVE-2026-55945; the Chrome flaw has the separate identifier assigned to its January fix.
Sources: Forever Security, Forever Security, Google
–
By the Control Plane Editorial Team