BragJack Browser Extension Attack: What BragJack Means for Your Browser Extension Security

Your browser is no longer just a window to the web. It’s an AI agent with a body: it reads your screen, clicks, types, opens files, and in some cases can turn on your camera and microphone. In September 2026, security researcher Gal Weizman showed how little it takes to take control of that body.

His technique, BragJack, was documented in a Cloud Security Alliance (CSA) research note. It used a single malicious browser extension to hijack the built-in AI assistants in five products:

1. Google Chrome’s Gemini Live panel
2. Perplexity Comet
3. Microsoft Edge
4. Opera Neon
5. Claude for Chrome.

There was no complex jailbreak or highly calculated prompt injection. The extension simply just needed two permissions that ad blockers and privacy tools ask for every day.

All five vendors have patched their variants, and CSA found no public evidence of real-world exploitation. But CSA is clear that the patches don’t close the underlying issue.

BragJack is a category-level risk for every agentic browser, and that makes the extensions in your fleet a frontline browser security and AI security concern.

Key Takeaways

What happened?

On September 17, 2026, the Cloud Security Alliance’s AI Safety Initiative published a research note on BragJack, a proof-of-concept technique disclosed by Gal Weizman of Forever Security.

How it works:

Agentic browsers split their AI assistant into two parts:

1. A privileged front-end inside the browser does the work (seeing the screen, clicking, typing, opening files).
2. A model on the vendor’s servers sends the instructions.

The front-end then has to decide which messages to trust, and it trusts the vendor’s own domain.

BragJack abuses that trust. With permission to modify page content and to use the declarativeNetRequest API, a malicious extension can:

1. Weaken or bypass the Content Security Policy on the page the AI assistant’s front-end loads.
2. Redirect that page’s JavaScript to attacker-controlled servers.
3. Inject code that commands the AI agent as if it came from the trusted vendor domain.

Impact by product (per CSA):

Disclosure was coordinated, and the five vendors paid bug bounties totaling roughly $20,500.

This isn’t the first time…

In March 2026, Weizman disclosed GlicJack, the original Chrome Gemini panel flaw, in which an extension with only declarativeNetRequest could inject JavaScript into the panel. BragJack extends that idea to four more products.

Separately, in May 2026, Manifold Security disclosed a synthetic-click flaw in Claude for Chrome that let a co-installed extension forge clicks. That’s two independent research efforts in five months with the same result: an unrelated extension sitting next to an AI agent gained influence over it.

Main idea: The browser is now an AI execution environment, and extensions are its weakest seam

BragJack works because agentic browsers put a high-privilege AI agent, with access to the camera, microphone, file system, and accounts, right next to low-privilege third-party extensions that can modify pages and intercept network traffic. Every major vendor built on the same extension permission model, so one technique worked across competing products.

That’s why CSA frames BragJack as a “monoculture” problem. Agentic browser features can inherit the security posture of whatever extension a user has installed, and vendor-side patching alone can’t fully fix that.

Palo Alto Networks addressed this and makes the same point, just from a different direction in its frontier AI security guidance. Frontier AI no longer just generates content.

It takes action, and risk lives at every connection point on the AI execution path, including browser sessions, SaaS connectors, and OAuth grants.

Browser extensions are one of the key ways AI enters the enterprise outside governance.

Agents don’t follow guidelines in a document. They do whatever it takes to get the task done.

Put together, the message is simple: you can’t govern AI agents in the browser without governing the extensions and OAuth apps that sit next to them. Patching fixes individual instances, but only governance addresses the whole category.

TL;DR

What this means for Browser Extension Security

1. The “one bad extension” is a base-rate problem, not an edge case.

BragJack needs only one malicious or compromised extension with common permissions. Spin.AI’s State of SaaS & Browser App Risk 2027 report (coming soon to the public) scored more than 1 million apps, including both browser extensions and OAuth applications. It found:

• 21.9% are rated critical risk
• 7.5% have known vulnerabilities
• 52.5% of extensions list no website, meaning no accountable publisher
• 15,526 are GenAI extensions

At those rates, most organizations should assume they have BragJack-shaped extensions installed right now.

This isn’t a new trend. Back in 2023, our Browser Extension Risk Report found 42,938 extensions with unknown authors, and organizations with 2,000+ employees averaged 1,454 installed extensions. This number has only grown.

2. Install-time permission prompts aren’t enough.

Neither permission BragJack uses looks alarming on an install prompt. Security teams need to look at combinations of permissions and whether each one matches the extension’s advertised purpose.

3. AI assistants are now extensions too.

Claude for Chrome was one of the five targets, and over 15,000 GenAI extensions are in circulation. Your extension program has to cover the AI agents themselves and limit what can sit alongside them.

4. One-time audits won’t keep up.

Three of the five fixes had no CVE. Extensions and apps need to be reassessed continuously as versions and permissions change. Risks need to be remediated as they occur, not as a static-point-in-time assessment.

5. The browser and SaaS are one attack surface.

AI agents act through browser sessions and SaaS connectors. A review that stops at extensions leaves OAuth grants unchecked and data exposed.

6. Switching browsers doesn’t solve it.

BragJack hit Chrome, Edge, Comet, Opera Neon, and an AI extension, which are the browsers people already use, including new agentic ones.

Moving everyone to a new vendor-managed browser is a heavy lift, and new agentic browsers and AI extensions keep arriving. Governance has to follow users across whatever browsers they run. This is why organizations need a browser security solution that is browser agnostic, and can meet the users where they’re at in order to offer true protection.

How SpinCRX combats incidents like BragJack, and how it could prevent this scenario

SpinCRX governs the extension and OAuth layer that BragJack exploited, across the browsers your employees already use. There’s no rip-and-replace and no new browser rollout.

Here’s how SpinCRX maps to the risks CSA and Palo Alto Networks identified:

How SpinCRX could have stopped a BragJack-style attack:

• Before install: SpinCRX’s risk assessment draws on a dataset of more than 1 million scored apps. It evaluates an extension’s publisher, permissions, known vulnerabilities, and data access, so an unknown extension asking for page-modification and network-interception rights, with no accountable publisher, gets flagged or blocked before it reaches a user.
• Already installed: Fleet-wide inventory surfaces every extension with the BragJack permission combination, so security teams can remove or restrict the ones without a clear business reason.
• Around AI agents: Allowlisting approved AI assistants and AI extensions, and controlling what extensions can sit next to them, shrinks the low-privilege-to-high-privilege gap BragJack depends on.
• Over time: Continuous re-scoring catches an extension that turns malicious through an update or ownership change. That matters because a legitimate-looking extension doesn’t need to start out bad.
• Across SaaS: Because the same AI agents act through SaaS, Spin.AI extends the same discovery, scoring, and revocation to OAuth apps, giving you one view of browser and SaaS app risk.

To be clear about scope: Spin.AI doesn’t patch browsers, replace prompt-injection defenses inside an LLM, or act as a model security platform. It closes the extension and OAuth seam that both the CSA identifies as the place where AI risk enters, which is exactly where BragJack got in.

Conclusion

BragJack has been patched, but the conditions that made it possible haven’t changed. AI agents with access to files, cameras, and accounts now live inside the browser, right next to extensions that most organizations have never inventoried.

CSA has now seen the pattern twice in six months, and the next variant will likely target whichever agentic browser or AI extension comes next.

Waiting for the next patch won’t protect you, and neither will moving everyone to a new browser. What will is governing the extension and OAuth layer you already have: know what’s installed, score its risk, enforce policy, and keep watching as things change.

Sources:

• Cloud Security Alliance AI Safety Initiative, “BragJack: One Extension Breaks Five Browsers’ AI Trust Model” (Sep 17, 2026)
• Palo Alto Networks Cyberpedia, “What Is Frontier AI Security?“
• Spin.AI, State of SaaS & Browser App Risk 2027 (data as of Oct 2026), coming soon.

Was this helpful?

Yes No