Cybersecurity and research outfit Forever Security has reported a way to manipulate AI assistants into hijacking a range of Chromium-based web browsers, potentially giving an attacker full access to any file on your computer. And it’s all done without needing to bypass any guardrails or rely on the victim lifting a finger.
In a blog posted on its website on Sept. 16, Forever Security stated that the new exploit – which researcher Gal Weizman dubbed BragJack – affected Gemini Live in Chrome, Microsoft Edge, Opera Neon, Perplexity Comet, and Claude in Chrome. Those AI tools could all be hacked using a single browser extension and are likely already installed on millions of users’ computers.
The extent of the damage depends on the browser you’re using. For instance, when BragJack is exploited on Google Chrome – by far the world’s most popular web browser – it granted access to the user’s local files, microphone and camera, browser profile and screenshot capabilities, all without requiring any clicks on the victim’s behalf. Only Comet also allowed local file access, and the camera and microphone were reachable on Chrome alone.
Forever Security said that the attack works because Chromium-based browsers have two separate parts: the body (the browser itself) and the brain (the AI assistant). The body takes action on your computer, such as capturing screenshots and viewing your data, while the brain tells the body what to do. In this example, the AI brain is not on your machine but instead lives in the cloud in the form of websites controlled by the AI provider.
Forever Security’s strategy was to insert a malicious middleman between the body and the brain, and the best way to do this was through the use of browser extensions. Ostensibly, extensions should only be able to modify websites, not browsers. But when it comes to AI assistants, the website (such as Google Gemini) can control your browser, so if an extension can manipulate that site, it could grant access to a browser through the back door.
How the exploit worked
The researchers were unable to inject nefarious scripts into the Gemini website, as this was blocked by Google. But they had more success with malicious network requests and were able to use the extension to tell the browser to load a JavaScript element that could run code inside the browser.
This granted them wide-ranging access, with Weizman explaining that: “I could take screenshots, read files from the Operating System, turn on the camera and microphone, and more. All with zero clicks from the user, using a flaw in the way Google set up the Gemini assistant.”
This was the initial exploit, which Forever Security called GlicJack and publicized earlier this year. But the researchers found that they were able to take the idea further and extend it to other browsers beyond Chrome.
In Microsoft Edge, the exploit involved hijacking Microsoft’s Copilot marketing page and quickly switching the AI from ‘thinking’ to ‘doing’ mode before it could react. When using Opera Neon, on the other hand, the attack could run in any place, because while the browser’s AI would only accept requests from opera.com, there was nothing stopping an extension from running code on that domain.
The worst case, Forever Security said, was Perplexity’s Comet browser. Unlike most browsers, this isn’t just an app with AI bolted on – the entire browser is built on AI, meaning that AI has access to a huge amount of your data. While Perplexity blocked all extensions from modifying its main perplexity.ai web address, the developers accidentally left a separate testing domain visible in the code, and this domain had far fewer protections in place. However, it still automatically redirected to perplexity.ai.
Forever Security exploited this by blocking the redirect and then injecting its own code using its extension. And thanks to the browser’s extensive use of AI (and, therefore, extensive permissions), they were able to take screenshots of the user’s machine, see every URL they had visited, access their personal information, control the AI as if it was the host, and even read any file on the target computer. And all of this was achieved with zero input from the victim.
A dangerous attack vector
This is not the first time we’ve seen AI assistants become attack vectors. In August, for example, Barracuda Networks discovered that virtual assistants attached to your email provider could be tricked into providing access to high-level accounts within an organization. A more recent case saw AI agents being cajoled into running malicious code hidden in git repositories by simply running their initial startup processes.
However, BragJack does appear to have uncovered some novel elements and vulnerabilities. For one thing, there is no malicious code involved – you just need to ask the AI to summarize a user’s emails in order to gain access to some serious secrets, for instance. That means that attacks like this are extremely hard to detect.
As well as that, hackers do not need a payload to cause damage, as merely asking the AI to perform actions can be enough to wreak havoc. The AI itself is the payload.
And because of the access the exploit provided, an attacker can continue to send follow-up prompts as and when needed. They’re not limited to any kind of prompt manipulation or workarounds – they’re in control of the prompt process from start to finish.
“While BragJack well demonstrates the dangers of integrating agents into browsers, in reality, the problem is much bigger,” Gal Bashan, CTO of Forever told Expert Insights.
“From desktop applications, through IDEs and browsers, to extensions and plugins – software is becoming agentic across the board. Since each of these layers converges into the endpoint, the shift in risk organizations become exposed to is unprecedented, forcing them to reposition their security posture to the upcoming challenges of the agentic era,” Bashan added.
Forever Security reported the findings to all five vendors and was awarded bug bounties by each: $7,000 from both Google and Perplexity, $5,000 from Microsoft, $900 from Opera and $600 from Anthropic. Two of the flaws received CVEs, tracked as CVE-2026-0628 for Chrome and CVE-2026-55945 for Edge. The Comet, Opera Neon and Claude in Chrome findings have no CVE and rest on Forever Security’s own account.
