BragJack: How We Hijacked 5 Of The World's Most Popular Browsers Using Their Built-In AI Assistants

Summary

Researchers at Forever Security published 'BragJack,' research demonstrating that the built-in AI assistants shipped in five of the world's most popular browsers — Google Chrome (Gemini), Perplexity Comet, Microsoft Edge, Opera Neon, and Claude in Chrome — could be hijacked. Notably, the researchers state they did not need to bypass AI guardrails or use prompt injection; every vulnerability shared the same critical design flaw and collectively earned tens of thousands of dollars in bounties from Google, Anthropic, Microsoft, Perplexity, and Opera.^[13]

Two CVEs were assigned as part of the work: CVE-2026-0628 in Chrome and CVE-2026-55945 in Microsoft Edge. CVE-2026-55945 is documented as a race condition (CWE-362) in Edge Chromium that lets an authorized local attacker win a narrow timing window to disclose information across a security boundary, and Microsoft addressed it through an MSRC advisory.^[13][16][37]

The BragJack findings sit within a broader, contemporaneous body of AI-browser agent-hijacking research. At Black Hat USA 2026, Zenity Labs disclosed a related vulnerability class it calls 'PleaseFix,' where hidden instructions inside emails, calendar invites, or web pages redirect an agent to act on an attacker's behalf. Researchers emphasize this is a fundamental design problem — agents cannot reliably tell ordinary content from malicious hidden instructions — for which there is no single patch.^[0]

Attack chain

1. Discovery / trigger surface: Google added its Gemini AI assistant into every Chrome user's browser via an 'Ask Gemini' button; a researcher probed it and found the assistant exploitable.^[13]
2. Agent architecture abuse: The Chrome agent is split into a 'body' (Chrome, which sees the screen, uses camera/microphone, accesses data, and executes actions) and a 'brain' (Gemini, which understands requests, plans steps, and sends instructions); the interaction between these components was abused.^[13]
3. Zero-click capability chain: Across the affected browsers, exploitation required zero clicks and enabled outcomes such as local file access, microphone and camera access, browser profile and history leaks, screenshot capture, and full browser-agent hijack.^[13]
4. Intent collision (related PleaseFix class): In the related Zenity Labs research, hidden instructions placed inside content the agent encounters (emails, calendar invitations, or web pages) collide with the user's legitimate request and redirect the agent to act with the user's own identity, permissions, and access.^[0]

Disclosure timeline

How it works

The core weakness is that agentic browsers' AI assistants combine and act on content from multiple sources (emails, documents, calendar invites, web pages) without reliably distinguishing trusted from untrusted content, effectively breaking the same-origin security model that keeps one website from accessing another's data. An attacker who slips hidden instructions into content the agent reads can weaponize the agent using the victim's own identity, permissions, and access.^[0]

In BragJack, the vulnerabilities shared a single critical design flaw and did not rely on prompt injection or on bypassing AI guardrails. The Chrome agent is structured as a 'body' (Chrome executing actions with data, camera, and microphone access) and a 'brain' (Gemini planning steps and issuing instructions), and the flaw allowed zero-click hijacking and data exfiltration.^[13]

CVE-2026-55945 is a race condition in Microsoft Edge (Chromium-based): multiple concurrent execution paths access a shared resource without adequate synchronization, so a precisely timed local attacker can observe an inconsistent intermediate state. The scope change means a successful exploit affects resources beyond the vulnerable component, such as content managed by another origin or renderer context; impact is bounded to partial confidentiality/integrity disclosure with no code execution, but leaked data can aid follow-on session-token theft, cross-origin reads, or credential harvesting. Attack complexity is high because the attacker must reliably win a narrow timing window.^[16][37]

Affected versions and patch status

Key takeaways

• The takeaway from the researchers is not 'there's a bug to patch' — it is that a hijackable insider now exists inside the environment, one that can be manipulated by everyday content and does not fit existing defensive assumptions; there is no single fix, though vendors can and should patch individual exploit paths.^[0]
• Agentic browsers fundamentally break the same-origin security model by combining and acting on content from different sources, so untrusted, tamperable web content is inherently part of how these agents operate.^[0]
• BragJack's authors stress that the attacks required no prompt injection and no guardrail bypass — the shared design flaw was 'something worse' — underscoring that the risk is architectural rather than a matter of model behavior.^[13]

Defensive actions

• Review the AI browser's settings and disable insecure defaults.: Zenity's Stav Cohen advises assuming the agent will be hijacked and stripping away everything it does not truly need; defaults should be reviewed and turned off where risky.^[0]
• Do not sign in to work accounts (email, AWS, GitHub, etc.) with an AI browser.: A hijacked agent acts with the user's own identity and access; keeping sensitive work accounts out of the AI browser limits the blast radius of an intent-collision takeover.^[0]
• Limit where the AI browser is allowed to act and do not rely solely on an 'ask before acting' pop-up.: The agent cannot reliably distinguish read-only content from hidden instructions, so consent prompts alone are insufficient; hard limits the agent cannot override should be enforced and shipped switched on by default.^[0]