One Ordinary Extension Hijacked Chrome, Edge, and Claude AI Before Anyone Clicked a Thing

Forever Security researcher Gal Weizman showed that one ordinary Chromium extension can take control of built-in AI assistants in Gemini Live in Chrome, Perplexity Comet, Microsoft Edge, Opera Neon, and Claude in Chrome. The demonstration, branded BragJack, was reported by The Hacker News on 16 September 2026. Dark Reading carried the same research.

The work is a lab demonstration, not exploitation observed in the wild, and not prompt injection. The earlier Chrome finding was named GlicJack. As of 16 September 2026, neither of the two assigned CVEs was on the U.S. Known Exploited Vulnerabilities catalog, and The Hacker News said there was no public evidence of a real-world attack.

The extension needed two common permissions: page modification of the kind ad blockers use, plus declarativeNetRequest. Together they let it seize the trusted page the built-in AI body listens to and send that body commands. The attack requires the malicious extension already installed and running. It is not a remote drive-by that works with no install.

Chrome is tracked as CVE-2026-0628, scored 8.8 by CISA, and fixed in Chrome 143.0.7499.192 in early January 2026. Capabilities there include reading local files, enabling the camera and microphone, and taking screenshots. Edge is CVE-2026-55945, scored 4.2, fixed in Edge 150.0.4078.48 on 2 July 2026, and can control the AI agent.

Comet, Opera Neon, and Claude in Chrome had no CVE yet in the reporting. Forever Security described Comet as the worst case: read files, browsing history, screenshots, and act as the user. The researchers said this is worse than prompt injection because the attacker can feed prompts directly through the hijacked trusted channel.

Forever Security said it earned about $20,000 in bug bounties across the five products. The per-product figures add up to $20,500 ($7,000 Chrome, $7,000 Comet, $5,000 Edge, $900 Opera, $600 Claude). Chrome and Edge have published fixed versions. For Comet, Opera Neon, and Claude in Chrome, Forever Security said each vendor paid a bounty, and The Hacker News said those three had no published fix date for the exact method. Dark Reading wrote that the issues have since been resolved.

Some offers on this page may be paid placements or contain affiliate links.