{
 "public_id": "AIR-2026-0245",
 "incident_id": "2026-09-forever-security-bragjack",
 "date_disclosed": "2026-09-16",
 "date_occurred": null,
 "title": "BragJack: one extension hijacks the built-in AI agents of Chrome, Edge, Opera Neon, Perplexity Comet and Claude in Chrome by injecting into their trusted control domains",
 "class": "responsible_disclosure",
 "attack_surface": "browser_agent",
 "initial_vector": "extension_script_injection_into_trusted_assistant_domain",
 "agent_capability_abused": [
  "task_execution",
  "authenticated_session_reuse",
  "screenshot_capture",
  "browsing_history_read",
  "file_system_read",
  "page_navigation"
 ],
 "target_product": "Gemini Live in Chrome; Microsoft Edge Copilot; Opera Neon; Perplexity Comet; Claude in Chrome",
 "target_vendor": "Google; Microsoft; Opera; Perplexity; Anthropic",
 "autonomy_level": "semi_autonomous",
 "impact_realized": false,
 "impact_type": [
  "unauthorized_actions",
  "data_exfiltration",
  "surveillance",
  "privilege_escalation"
 ],
 "blast_radius": "users of the five browsers/assistants who install one ordinary extension able to inject into or rewrite requests for the assistant's trusted domain (e.g. gemini.google.com, perplexity.ai)",
 "cve": [
  "CVE-2026-55945"
 ],
 "taxonomy": {
  "owasp_asi": [
   "ASI01",
   "ASI03"
  ],
  "mitre_atlas": [],
  "labels": [
   "prompt_forcing",
   "extension_permission_model",
   "trusted_domain_injection",
   "declarativeNetRequest",
   "privileged_page_injection",
   "confused_deputy",
   "cross_vendor",
   "no_prompt_injection_needed"
  ]
 },
 "defense_present": "browser trust boundary that lets the assistant 'body' take orders only from one trusted web page; assistant guardrails",
 "defense_bypassed": true,
 "fix_shipped": "Chrome 143.0.7499.192 (CVE-2026-0628) and Edge 150.0.4078.48 patched per THN; researcher reports all five vendors paid bounties (Chrome $7,000, Comet $7,000, Edge $5,000, Opera Neon $900, Claude in Chrome $600); remediation dates for Comet, Opera Neon and Claude in Chrome not stated",
 "primary_sources": [
  "https://forever.security/blog/bragjack-hijacking-5-browsers-via-built-in-ai-assistants/",
  "https://thehackernews.com/2026/09/one-extension-could-hijack-ai.html",
  "https://www.bleepingcomputer.com/news/security/bragjack-attacks-hijack-ai-browser-agents-through-malicious-extensions/"
 ],
 "verified_quote": "All the vulnerabilities we discovered shared the same critical design flaw, and totaled tens of thousands of dollars in bounties from Google, Anthropic, Microsoft, Perplexity, and Opera.",
 "confidence": "high",
 "notes": "Gal Weizman, Forever Security, published 2026-09-16; THN 2026-09-16, BleepingComputer 2026-09-19. Model: each built-in assistant has a privileged 'body' in the browser that only takes orders from one trusted web page (the 'brain' front end, e.g. gemini.google.com, perplexity.ai); an ordinary extension uses content scripts or declarativeNetRequest to get code into that page and then writes and sends entire prompts plus follow-ups. The researcher calls this Prompt Forcing and states explicitly it is not prompt injection. Comet was the worst case: the researcher lists taking screenshots of everything the user does, seeing every URL ever visited, reading user information, controlling the agent to act as the user, and reading any file on the operating system. CVE ATTRIBUTION CONFLICT: the Forever Security impact table attaches CVE-2026-55945 to Perplexity Comet, while THN and BleepingComputer attach it to Microsoft Edge (CVSS 4.2, fixed 150.0.4078.48); recorded both CVEs, attribution unresolved. The Chrome component (CVE-2026-0628, earlier named GlicJack) was already disclosed in March 2026 and is AIR-2026-0055; BragJack is the wider five-product coordinated disclosure, hence a separate record with AIR-2026-0055 as an evidence xref. Distinct from AIR-2026-0208 (ClaudeBleed reopened, Manifold, synthetic click via isTrusted omission) and AIR-2026-0196 (PleaseFix, Zenity): different researcher and mechanism, same extension-to-agent privilege boundary. THN: as of 2026-09-16 neither CVE was in CISA KEV and no evidence of real-world use. autonomy_level=semi_autonomous because the forced agent carries out multi-step tasks with the user's sessions and privileges (matches Comet neighbours). CVE-2026-0628 removed from this record's cve list on 2026-09-21 because AIR-2026-0055 already holds it; this record covers the four newly disclosed products.",
 "risk_category": "security_fraud",
 "risk_secondary": [
  "privacy",
  "product_misuse"
 ],
 "risk_subcategory": "Prompt Injection",
 "risk_sub_secondary": [
  "Unauthorized Access & Account Takeover"
 ],
 "ai_entity": "generative",
 "agency": "agent_acted",
 "agency_debatable": true,
 "agency_reason": "a malicious extension drove the built-in agents to act on the attacker's behalf without prompt injection",
 "vector_family": "other",
 "vector_detail": "extension_script_injection_into_trusted_assistant_domain",
 "guardrail_kind": [
  "unknown"
 ],
 "guardrail_outcome": "silent",
 "xrefs": {
  "aiid": [],
  "atlas": [],
  "cve": [
   "CVE-2026-55945"
  ],
  "ghsa": []
 },
 "primary_asi": "ASI01",
 "agent_framework": "perplexity_comet",
 "model_provider": "multiple",
 "model_name": "",
 "detection_mechanism": "unknown",
 "tool_access": "unknown",
 "financial_loss_band": "unknown",
 "eai_category": "unsafe_actuation",
 "eai_domain": "agent_behaviour",
 "eai_secondary": [
  "privilege_escalation",
  "data_exfiltration_channels",
  "confused_deputy"
 ],
 "eai_reason": "impact rule: unsafe_actuation",
 "asi_curated": [],
 "asi_scope": "in_scope",
 "asi_provenance": "rule",
 "asi_reason": "ASI01 (vector=injection); ASI03 (signal=identity)",
 "submitted_by": "EAI Internal"
}