Giving a browser agent access to tabs and web actions changes the stakes of an extension mistake. Forever Security’s BragJack research demonstrates how an installed extension could cross boundaries around several AI browser features, sometimes issuing commands that the user never asked the agent to perform.

TL;DR

  • Forever Security demonstrated five product-specific attacks involving Chrome’s Gemini feature, Perplexity Comet, Edge Actions, Opera Neon, and Claude in Chrome.
  • The proof of concept requires a malicious extension to be installed first. The documented impact differs by product; it is not one universal file-theft flaw.
  • Inventory extensions on browsers with AI features, restrict broad host access, and update affected products as vendor fixes become available.

One Entry Point, Different Failures

The September 16 technical report describes an extension with network-request permissions and broad host access. Depending on the product, it could modify security headers, redirect scripts, or reach a page that could instruct an agent. Some paths let the extension force prompts into an agent that could act on websites. Other paths exposed browser capabilities directly.

The distinction matters. The researchers’ impact table shows local file access for Chrome’s Gemini feature and Comet, but not for Edge Actions, Opera Neon, or Claude in Chrome. It lists agent hijacking for Comet, Edge Actions, Opera Neon, and Claude in Chrome, but not for Chrome’s Gemini feature. A statement that all five products allowed the same data theft would overstate the finding. The report presents proof-of-concept exploitation; it does not establish a live criminal campaign.

The research identifies two CVEs, one involving Chrome and one Edge. Product fixes and versions should be checked against each vendor’s current advisory before treating a fleet as patched. The common architectural lesson is broader than either CVE: an extension and an AI agent share a browser, but should not inherit each other’s authority.

Review the Browser as a Privileged Workspace

An administrator can start with a browser extension inventory: extension ID, publisher, deployment source, requested host permissions, and whether it can alter network requests. Compare that inventory with managed-browser policy, then remove extensions the organization did not approve. Investigate unexpected changes to that list alongside unusual agent actions or access to sensitive tabs.

Update browsers and agent extensions through managed channels. Limit which AI agents can access sensitive work sites, and require explicit human confirmation for actions such as sending mail or changing account settings where the product supports it. These controls reduce blast radius even when an extension flaw has a vendor fix.

For individual users, the immediate check is concrete: review installed extensions and their site access, uninstall ones you do not recognize, and update the browser and AI assistant. Disabling an AI feature may be appropriate on high-sensitivity profiles until its permissions and patch status are understood.

Sources