AI SecurityShadow AIAI Agents
Browser extensions have always been a quiet risk that most security teams have made peace with. A screenshot tool, a password manager, a grammar checker, a tab organiser — each one asks for broad permissions, each one gets them, and the honest reason they get approved is that the damage an extension could do was bounded by what a browser could do. Read pages. Change pages. Send network requests. Bad, but a known shape.
That boundary moved this year, and almost nobody re-ran the risk assessment. Browsers now ship AI assistants that are not web pages. They are privileged components with access to local files, screenshots, browsing history, camera and microphone, and — in the agentic ones — the ability to go and do things in sites where the user is already logged in.
Research published this week shows that a single already-installed extension can take that assistant over and use every one of those privileges. The researcher calls it BragJack.
Gal Weizman of Forever Security disclosed the technique in September 2026, with coverage from BleepingComputer and Dark Reading. The proof of concept worked against five Chromium-based browsers and browser assistants:
Two CVEs came out of it. CVE-2026-0628 is the Chrome issue, rated 8.8, fixed in Chrome 143.0.7499.192/.193. CVE-2026-55945 is the Edge race condition, rated medium, fixed before version 150.0.4078.48. Google and Microsoft have both resolved the flaws they were assigned. The disclosures earned roughly $20,000 in combined bounties across the five vendors, individual awards ranging from $600 to $7,000.
This is the part worth slowing down for, because it determines which of your controls are relevant.
The malicious extension needs two things: host permissions for the target sites, and authority over Chromium's declarativeNetRequest API — the same API legitimate content blockers and privacy extensions use. Some attack paths additionally want debugger permission to simulate clicks. None of this is exotic. It is the permission set of a large share of the extensions sitting in your fleet right now.
With declarativeNetRequest, the extension intercepts traffic heading to the assistant's own privileged context. It redirects legitimate JavaScript requests to attacker-controlled code, weakens Content Security Policy headers, strips redirect headers, and changes the rules about what may embed what. The result is attacker code running inside the AI assistant's privileged context rather than beside it.
From there the technique Weizman names Prompt Forcing takes over. It is worth distinguishing from the prompt injection everyone has spent two years worrying about:
That distinction is the whole story. The compromise happens at the authorisation and message-channel layer, before the model ever evaluates intent. Which means model-level safety filters cannot correct it. A better-aligned model, a stricter system prompt, a jailbreak classifier — none of these are in the path. The agent is not misbehaving. It is following instructions from a source that has been granted the right to give them.
We wrote on 17 September about an attacker hijacking an AI coding-assistant session to get a poisoned package accepted across around a hundred repositories. The pattern repeats here at a different layer: the attacker does not need to fool the human or the model. It is enough to become the thing one of them already trusts.
Three things change when the assistant is in the trust path.
The blast radius is the user's whole session, not one tab. An agentic assistant that can visit sites, summarise inboxes and act where the user is authenticated is a general-purpose actuator for everything that user's browser can reach. A compromised extension used to mean stolen form data from the pages it had permission for. Now it can mean anything the employee could have done at a keyboard.
Patching the browser does not close the category. Google and Microsoft fixed the specific flaws they were assigned. That is real and you should ship those updates. But the underlying structure — a privileged AI component sharing a browser with third-party extensions the user chose — is a design surface, not a bug. Comet, Neon and Claude in Chrome were all demonstrated against, and the published record of fixes for those three is thinner than for Chrome and Edge.
Most of this surface is not on your inventory. The uncomfortable arithmetic: you probably do not have a current list of which employees have an AI-enabled browser, which assistant is active in it, what that assistant can reach, or which extensions are installed alongside it. Extension governance has historically been an endpoint-management footnote. It is now an AI-access-control question, and the two are usually owned by different teams.
The practical advice from the coverage is sound and worth doing this week: update Chrome and Edge now, enforce an extension allow-list rather than a block-list, treat broad permission grants — especially declarativeNetRequest and debugger — as an approval gate, and watch for browser-driven access to files, camera and authenticated applications. And treat AI-agent activity as its own telemetry stream rather than folding it into general browsing logs.
The boundary first, because it matters here. Obichat does not sit inside your employees' browsers. It cannot detect a malicious extension, it cannot stop declarativeNetRequest from rewriting traffic, and it will not patch Chrome for you. Extension governance belongs in your endpoint management and browser enterprise policy. Nothing in this article changes that.
What Obichat changes is a prior question: where your organisation's AI work happens in the first place.
BragJack is only as serious as the amount of company business flowing through browser-resident AI assistants. For most organisations that number is unknown and rising, because the assistant arrived in an update rather than through a procurement process. Obichat is the alternative front door — a governed multi-model chat workspace your teams actually want to use, so the sensitive work has somewhere to go that isn't fused into a browser session alongside a grammar extension from 2024.
Workspaces with their own model connections. Every team gets an Obichat workspace with its own connected AI providers and a model allow-list. IT decides which models each workspace may reach. That is a different posture from an assistant that ships enabled by default and inherits whatever the browser can see.
Inspection before the prompt leaves. Every message in a workspace passes through Obiguard's inspection layer, governed by the policy set assigned to that workspace — PII and PCI redaction, keyword and regex block-lists, jailbreak and prompt-injection detection. Applied in-path, before the text reaches a model. This is not a defence against Prompt Forcing, which happens in a browser Obichat isn't in. It is a reason that the contract, the customer list and the incident write-up are in a governed workspace rather than in a browser assistant's conversation history.
An activity log you can actually export. Security and compliance get a per-workspace activity log of conversations and events, exportable to CSV, with redacted-message visibility for reviewers and controls tagged against the frameworks you are building toward — NIST AI RMF and ISO/IEC 42001. The mitigation advice says to treat AI-agent activity as distinct telemetry. For traffic through Obichat, it already is.
Identity you already run. SAML 2.0 and OIDC single sign-on, workspaces scoped private or team-wide, settings locked to admins. When an employee leaves, their AI access leaves with the IdP entry. A browser assistant signed into a personal Google account does not have that property.
None of this makes a hijacked browser safe. What it does is give the AI work a governed place to happen, so the question "what did our staff send to an AI last quarter?" has an answer that doesn't depend on surveying browsers one by one.
The security industry spent two years building defences against prompt injection — content filtering, instruction hierarchies, injection classifiers. That work was correct and it is still needed. But it all assumes the attack arrives as content, addressed to a model that then has to be fooled.
BragJack arrives as authorisation. It does not need to fool anything. And the permission that made it possible was granted years ago, by an employee, to an extension that did something useful, at a time when a browser extension could not talk to an AI agent because there was no AI agent in the browser to talk to.
That consent was given under a threat model that has since been quietly replaced by a software update.
So the question for your security team is not have we patched Chrome? You will have, by Friday.
It is: which extensions in your fleet were approved before the browser shipped an AI agent — and who has re-read those permission grants since?
Explore Obichat or talk to us about giving your teams a governed AI workspace, so the sensitive work isn't happening in whatever assistant the browser turned on last month.
Obiguard sits in front of every AI request your organization makes — screening prompts and outputs against the guardrails, compliance frameworks, and audit trails that stories like this one make necessary.
See how it works →