What happened
Security researcher Gal Weizman (Forever Security) disclosed BragJack (published 16 Sept, amplified through the window) - a novel 'prompt forcing' technique where the attacker controls the entire prompt and its timing by hijacking the trusted page-to-assistant channel, rather than classic prompt injection of the model. Demonstrated across Chrome/Edge/Opera Neon/Comet/Claude for Chrome; two CVEs assigned.
Why it matters
Novel agentic attack class: attacker-specified commands drive a privileged browser AI agent that can act on local files, credentials, and webmail - a realistic pivot for enterprise AI-assistant deployments where the assistant holds high-value context and tool access.
Attack vector
A malicious browser extension with two common ad-blocker-style permissions hijacks the trusted page channel between an AI browser assistant and its privileged 'body' component, then supplies attacker-chosen prompts directly to the browser's privileged control plane (bypassing model-level safety) - demonstrated to read local files, take screenshots, and exfiltrate email summaries.
Affected systems
Chrome Gemini Live, Microsoft Edge Copilot agent, Opera Neon, Perplexity Comet, Claude for Chrome (reported CVEs CVE-2026-0628 Chrome, CVE-2026-55945 Edge)
Mitigation
Google and Microsoft patched their assigned CVEs; update Chrome and Edge; audit/remove unneeded extensions; vendors patched as applicable. Applies to enterprise endpoints running AI-enabled browsers.