An Ordinary Extension Could Tell Your Browser's AI to Go Read Your Email

The researcher never tricked the AI. He became the thing it listens to.

Gal Weizman installed a browser extension of the kind millions of people already run, the ad blockers and coupon finders nobody thinks twice about. He then used it to tell the AI assistant inside Perplexity's Comet browser to read files off his operating system. It did. The same approach worked on Google Chrome, Microsoft Edge, Opera Neon and Claude in Chrome. Five of the most widely used agentic browsers in the world, one technique, no clicks required from the user.

The interesting part is what he skipped. He did not hide instructions inside a web page and hope the assistant would read them. He did not jailbreak anything. He took over the channel the assistant already trusts and issued orders through it, which turns out to be a far shorter route than fooling a model.

What the research found

Weizman, a browser vulnerability researcher at Forever Security, published the work on 16 September 2026 under the name BragJack. Google, Microsoft, Opera, Anthropic and Perplexity each confirmed a flaw in their own product and paid a bounty, from 600 dollars at Anthropic up to 7,000 dollars each at Google and Perplexity, more than 20,000 dollars in total. Google and Microsoft assigned CVE identifiers, the public catalogue numbers given to confirmed vulnerabilities: CVE-2026-0628 for Chrome and CVE-2026-55945 for Edge. All five issues have since been fixed.

The mechanism deserves a slow read, because it is the same one in every case. A browser assistant has two halves. The body sits inside the browser and holds the real power: it can screenshot your tabs, reach the camera and microphone, read local files and click things on your behalf. The brain is the model running on the vendor's servers, and it tells the body what to do. To keep that arrangement safe, each browser lets its body take commands from exactly one trusted web page. Extensions, meanwhile, get two abilities almost nobody restricts: they can inject JavaScript into pages, and they can modify the network traffic between the browser and the internet. Weizman used those two ordinary abilities to reach the trusted page, and once there he was talking straight to the body. On Chrome, Google had blocked extensions from running scripts on the Gemini page but not from rewriting the requests that load it, so he substituted a script of his own. On Opera Neon, opera.com blocked nothing at all. Perplexity did block extensions on perplexity.ai properly, but its agent also trusted a leftover developer domain, testing.perplexity.com, defended only by a redirect sitting in a response header. An extension can delete a header.

• Microsoft had split its agent into a Think mode that accepts prompts and a Do mode that takes actions, deliberately so that neither could do both. Weizman sent a prompt in Think mode and flipped to Do mode mid-thought. The agent carried out the instruction.
• The Comet exploit gave the deepest access: screenshots of everything the user does, every URL ever visited, the user's profile data, actions taken as the user, and any file on the operating system.
• Weizman calls the technique prompt forcing rather than prompt injection. The attacker writes the whole instruction, chooses when it lands, and keeps sending follow-up prompts to steer the agent as it works.

Why it matters

Nobody lost money here, because this was research and the vendors patched. The exposure was real while it lasted. Weizman's estimate is that anyone running one of those five browsers with at least one extension installed was reachable, which is hundreds of millions of people, and his demonstrations were not abstract: he had Opera Neon and Claude in Chrome open a mailbox, summarise the finance correspondence and send it out. For your organisation the awkward part is detection. There is no malware in this attack. A trusted browser does something it is permitted to do, because a trusted page asked it to, in plain English. Endpoint detection and response tools, the software watching your laptops for malicious activity, are built to find code, and there is no code to find. So the question for your security team this week is narrower than whether you were exposed to BragJack, and harder to answer: if an approved application on a managed laptop started reading mailboxes and sending the contents outside, which of your controls would produce an alert at all?

The shift underneath it is that the browser quietly stopped being a document viewer. It now ships an autonomous agent that holds the user's own permissions, and extensions are still governed by the old assumption that the worst an extension can do is tamper with a web page. Weizman found five different mistakes across five vendors, which tells you this is not one company being careless. It is a boundary that was drawn before there was anything this valuable sitting on the other side of it.

What to do about it

1. Force Chromium-based browsers to current versions and verify the result rather than trusting auto-update. All five vulnerabilities are fixed, so the only population still exposed is the one running a stale build, and that population is always larger than the dashboard suggests.
2. Cut your extension allowlist down to what somebody has actually reviewed. The attack needs one extension with ordinary permissions to be present, and an extension that quietly changes owners becomes a different piece of software overnight without changing its name in your inventory.
3. Pull the browser agent's interaction logs with its AI provider and read them. This is Weizman's own suggestion for security operations teams, and it works precisely because the attack leaves no file and no process behind, only a conversation.

Bottom line

Keep this detail. Anthropic rated its own issue medium severity, the mildest of the five, because Claude in Chrome is an extension being exploited by another extension rather than a browser being broken open. That is a defensible call, and it is also the shape of the whole problem. Every one of these bugs was a small mistake about which page to trust, and each small mistake sat directly in front of an agent carrying the user's full permissions. Take it to your next review as a question about blast radius rather than patching: now that the software on your endpoints has an agent inside it, what is the worst thing a configuration slip can authorise?