decrypted · 19 september 2026 · ransomware and cybercrime · vulnerabilities and patching · ai and llm security

One browser extension can take over the AI assistant built into your browser

Researchers have shown that one browser extension, asking for two everyday permissions, can take over the AI assistants built into five browsers: Chrome, Edge, Perplexity's Comet, Opera Neon and Claude in Chrome. BleepingComputer reported the technique, named BragJack, today. There is no public evidence of it being used in the wild, but it is a tidy demonstration of what goes wrong when an AI assistant is handed the keys to the machine.

What BragJack does

Forever Security researcher Gal Weizman found that each of these assistants has two halves. The "body" runs inside your browser and can see the screen, and in some products read files or use the camera and microphone. The "brain" sits on the vendor's servers and issues the commands. The body only takes orders from one trusted web page, such as gemini.google.com for Chrome.

Think of a valet who only follows instructions from the hotel reception desk. BragJack does not argue with the valet. It slips a note onto the reception desk's notepad, and the valet obeys. The malicious extension injects its own code into the trusted page and talks to the assistant as though it were the vendor. It needs only a permission that changes web pages, common in ad blockers, and declarativeNetRequest, which alters browser network traffic.

This is not classic prompt injection, where hidden text tricks a model. The attacker hands the agent a complete instruction, and the agent carries it out with the user's own privileges.

How bad, by product

According to The Hacker News, the outcomes differed widely:

Comet: the worst case. The extension could read any file, list visited sites, take screenshots and act as the user. The researchers got in through testing.perplexity.com, which lacked the lockdown of the main site.
Opera Neon: the easiest target, because opera.com had no extension restrictions.
Edge: Microsoft's defences forced the researchers to chain two weaknesses. It is tracked as CVE-2026-55945, rated 4.2, and fixed in version 150.0.4078.48.
Chrome: CVE-2026-0628, rated 8.8, fixed in 143.0.7499.192 in January.
Claude in Chrome: the mildest, one extension abusing another, which Anthropic rated medium.

The five vendors paid around $20,000 in bounties in total. The attack assumes the victim has already installed the extension, which is the starting point for many browser attacks.

The Secure by Design lesson

Three design choices made this possible. Trust was anchored to a web address, so a forgotten test site or marketing page became a command channel. The assistants held broader privileges than any single task needs. And the extension model treats "read and change data on websites" as a routine request.

For UK organisations, my opinion is that an AI browser is privileged software, not a productivity toy. Allow extensions by exception rather than by default, keep browsers patched, and ask vendors plainly what an assistant can reach by default and whether you can switch that off. Opinion, not advice.

Also this week

Linux kernel flaws under attack. CISA added two Linux kernel vulnerabilities to its Known Exploited Vulnerabilities catalogue on Friday: CVE-2026-53266, an out-of-bounds write in the ebtables SNAT path rated 8.8, and CVE-2025-39964, a race condition in the AF_ALG cryptographic socket interface. The Hacker News notes there are no public details on how they are being exploited. Both are local flaws, so an attacker needs a foothold first, which makes them a concern for shared servers, containers and anywhere a phished account already exists. Check your distribution's advisories.

Fake job interviews, real malware. Japan's National Police Agency, with the FBI and agencies in Australia and Germany, published details of a North Korean campaign called WaterPlum. It reports more than 30,000 infected devices across over 100 countries between December 2025 and July 2026, more than 7,000 cryptocurrency wallets identified and about 1.7 billion yen moved to North Korea. Fake recruiters for AI and crypto firms asked developers to run "coding tests". The agencies advise testing unknown code in virtual machines, using VS Code Restricted Mode and verifying applicants. UK firms that hire developers or contractors should note that a developer's laptop is a short route into the employer's network.

Sources