Loading story…
Researcher Gal Weizman of Forever Security disclosed BragJack, a proof-of-concept attack in which a malicious Chromium extension uses prompt forcing to seize control of built-in AI assistants. The technique affects Gemini Live in Chrome, Perplexity Comet, Microsoft Edge, Opera Neon, and the Claude for Chrome extension; it requires a victim to first install an extension granted ordinary page-modification and declarativeNetRequest permissions. No confirmed in-the-wild exploitation has been reported.
Once an AI agent is compromised, it could read local files and web content, capture screenshots, and perform actions as the logged-in user, including processing and sending email content. Google addressed the Chrome component as high-severity CVE-2026-0628 (CVSS 8.8), an insufficient-policy-enforcement flaw in the WebView tag reported by Weizman, in Chrome 143.0.7499.192/.193; Microsoft fixed the related Edge issue, CVE-2026-55945, in Edge 150.0.4078.48. Organizations should ensure managed browsers are updated and restrict extension installation to approved sources.
Trace attribution and downstream blast radius.
4 events from the most recent confirmed update back to the earliest known activity.
Gal Weizman reported CVE-2026-0628, a high-severity insufficient-policy-enforcement vulnerability involving Chrome's WebView tag, to Google.
Microsoft assigned CVE-2026-55945 to an Edge race condition that could enable prompt delivery while switching between Think and Do modes, and fixed it in Edge 150.0.4078.48.
Forever Security researcher Gal Weizman demonstrated BragJack, or Prompt Forcing, a proof-of-concept technique in which a malicious browser extension can directly supply controlling prompts to built-in browser AI assistants. The technique was demonstrated against Gemini Live in Chrome, Perplexity Comet, Microsoft Edge, Opera Neon, and Claude for Chrome; no real-world attacks were observed.
Google released Chrome Stable 143.0.7499.192/.193 for Windows and macOS and 143.0.7499.192 for Linux, including a fix for CVE-2026-0628.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
3 references tracked. Mallory keeps watching after this page renders.
xakep.ru
Open sourceforever.security
Open sourcechromereleases.googleblog.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Forever Security disclosed **BragJack**, a proof-of-concept attack in which a malicious browser extension can abuse trusted communication paths between webpages and browser-based AI assistants to issue commands appearing to originate from a vendor-authorized source. The technique affected Gemini Live in Chrome, Microsoft Edge Copilot, Opera Neon, Perplexity Comet, and Claude in Chrome; potential impact ranged from AI-agent control to access to local files, browser-profile data, browsing history, screenshots, and—in Chrome—camera and microphone access. Exploitation requires a victim to install and run the malicious extension, which can use webpage-modification capabilities and `declarativeNetRequest` rules to manipulate trusted origins, resources, or message channels. Google fixed the Chrome Gemini flaw, tracked as **CVE-2026-0628** (CVSS 8.8), in Chrome 143.0.7499.192/.193, while Microsoft fixed the Edge Copilot race condition, **CVE-2026-55945**, in Edge 150.0.4078.48. Researchers reported no evidence of in-the-wild exploitation; organizations should patch affected browsers, allowlist extensions, restrict broad host, DNR, and debugger permissions, and monitor sensitive AI-agent activity.
Sep 19, 2026
Researchers at Cato Networks have identified a new attack technique called **HashJack**, which leverages the fragment portion of URLs (the section after the `#` symbol) to hide malicious prompts. This method specifically targets AI browser assistants such as Copilot in Edge, Gemini in Chrome, and Comet from Perplexity AI. When users interact with these AI-powered browsers, the hidden instructions in the URL fragment are processed by the large language model, potentially leading to outcomes like data exfiltration, phishing, misinformation, malware guidance, or even harmful medical advice. Traditional network and server-side defenses are unable to detect these attacks because URL fragments are never transmitted beyond the client, making legitimate websites unwitting vectors for exploitation. The HashJack attack is a form of indirect prompt injection, where attackers craft links to trusted sites with appended malicious instructions after the `#` symbol. Unsuspecting users who click these links and then use their AI browser assistant may trigger the hidden prompts, which can manipulate the assistant to perform harmful actions or leak sensitive data. The risk is heightened in agentic AI browsers, where the assistant may autonomously send user data to attacker-controlled endpoints. Security researchers warn that this technique can weaponize any legitimate website, underscoring the urgent need for improved defenses in AI browser architectures against prompt injection threats.
Jun 29, 2026
Security researchers reported multiple risks tied to **AI-themed browser extensions** in the Chrome/Edge ecosystem, including active malicious campaigns. Malwarebytes identified **16 malicious extensions** (15 Chrome, 1 Edge) masquerading as ChatGPT “enhancers” that **steal ChatGPT session tokens**, enabling attackers to take over accounts and access conversation history and metadata; the extensions also exfiltrate additional telemetry (e.g., extension version/language and usage details) to help attackers profile victims and maintain longer-term access. Separately, Varonis described a new **malware-as-a-service** offering called **“Stanley”** that claims to reliably get **phishing-capable Chrome extensions** through Chrome Web Store review, using full-screen `iframe` overlays to present attacker-controlled login pages while the address bar continues to show the legitimate domain; it also advertises auto-install support across Chrome/Edge/Brave, a management panel, geo/IP targeting, and frequent C2 polling. In parallel with these overtly malicious cases, an Incogni study of **442 AI-powered Chrome extensions** found broad privacy and security exposure from over-privileged extensions (e.g., script injection and deep page access) and extensive data collection (52% collecting user data), highlighting that even popular tools (e.g., **Grammarly** and **QuillBot**) can present significant privacy risk due to the scope of permissions and data categories collected.
Jun 29, 2026