BragJack: one extension hijacks the built-in AI agents of Chrome, Edge, Opera Neon, Perplexity Comet and Claude in Chrome by injecting into their trusted control domains

users of the five browsers/assistants who install one ordinary extension able to inject into or rewrite requests for the assistant's trusted domain (e.g. gemini.google.com, perplexity.ai)

Gal Weizman, Forever Security, published 2026-09-16; THN 2026-09-16, BleepingComputer 2026-09-19. Model: each built-in assistant has a privileged 'body' in the browser that only takes orders from one trusted web page (the 'brain' front end, e.g. gemini.google.com, perplexity.ai); an ordinary extension uses content scripts or declarativeNetRequest to get code into that page and then writes and sends entire prompts plus follow-ups. The researcher calls this Prompt Forcing and states explicitly it is not prompt injection. Comet was the worst case: the researcher lists taking screenshots of everything the user does, seeing every URL ever visited, reading user information, controlling the agent to act as the user, and reading any file on the operating system. CVE ATTRIBUTION CONFLICT: the Forever Security impact table attaches CVE-2026-55945 to Perplexity Comet, while THN and BleepingComputer attach it to Microsoft Edge (CVSS 4.2, fixed 150.0.4078.48); recorded both CVEs, attribution unresolved. The Chrome component (CVE-2026-0628, earlier named GlicJack) was already disclosed in March 2026 and is AIR-2026-0055; BragJack is the wider five-product coordinated disclosure, hence a separate record with AIR-2026-0055 as an evidence xref. Distinct from AIR-2026-0208 (ClaudeBleed reopened, Manifold, synthetic click via isTrusted omission) and AIR-2026-0196 (PleaseFix, Zenity): different researcher and mechanism, same extension-to-agent privilege boundary. THN: as of 2026-09-16 neither CVE was in CISA KEV and no evidence of real-world use. autonomy_level=semi_autonomous because the forced agent carries out multi-step tasks with the user's sessions and privileges (matches Comet neighbours). CVE-2026-0628 removed from this record's cve list on 2026-09-21 because AIR-2026-0055 already holds it; this record covers the four newly disclosed products.