Affected Systems

AI assistants in Google Chrome, Microsoft Edge, Opera Neon, Perplexity Comet, and Anthropic Claude (Chrome). Attack vector: malicious browser extensions using Prompt Forcing technique. Specific affected versions not disclosed.

Exploitation Status

Proof-of-concept published by Forever Security researcher Gal Weizman. Two CVEs assigned (identifiers not disclosed in source). Earned $20,000+ in bug bounties, indicating vendors acknowledged the issue. No evidence of active in-the-wild exploitation.

Business Impact

Organizations using AI assistants in affected browsers face risk of prompt injection attacks via malicious extensions. Attackers could manipulate AI responses, exfiltrate sensitive data from conversations, or poison AI outputs. Impact depends on trust users place in AI assistant responses and sensitivity of data processed. Browser extension supply chain remains a key attack surface.

Urgency

🟡 Within a week

Recommended Actions

  • Audit and restrict browser extension installations via Group Policy (Chrome/Edge) or enterprise management tools to approved extensions only
  • Review currently installed extensions in Chrome (chrome://extensions), Edge (edge://extensions), and Opera for unknown or suspicious add-ons
  • Monitor vendor security advisories from Google, Microsoft, Opera, Perplexity, and Anthropic for patches addressing the two assigned CVEs
  • Educate users on risks of installing third-party browser extensions and AI prompt injection attacks
  • Consider disabling or restricting AI assistant features in enterprise browsers until patches are confirmed deployed

---

# Threat Actor Context

Actor Profile

Gal Weizman is a security researcher affiliated with Forever Security who conducted vulnerability research targeting AI assistant integrations in web browsers. The research was conducted as a proof-of-concept demonstration of security weaknesses in browser-based AI assistants, resulting in responsible disclosure with bug bounty rewards exceeding $20,000 and the assignment of two CVEs. This represents legitimate security research rather than malicious threat actor activity.

TTPs (Tactics, Techniques, Procedures)

The BragJack proof-of-concept leverages a Prompt Forcing technique delivered through malicious browser extensions to hijack AI assistant functionality. The attack vector targets the extension ecosystem across multiple Chromium-based browsers (Chrome, Edge, Opera Neon) as well as specialized AI browsers (Perplexity Comet) and AI assistant implementations (Claude in Chrome). The technique exploits the trust boundary between browser extensions and integrated AI assistants, manipulating prompt handling to achieve unauthorized control. This aligns conceptually with T1176 (Browser Extensions) for initial access and T1056 (Input Capture) for the prompt manipulation mechanism.

Targets & Patterns

The research targeted technology companies operating AI assistant platforms integrated into web browsers, specifically affecting Chrome, Microsoft Edge, Opera Neon, Perplexity Comet, and Anthropic's Claude browser implementation. The focus on browser-based AI assistants reflects an emerging attack surface as AI capabilities become deeply integrated into user workflows. The vulnerability impacts the software development and technology sectors broadly, as these AI assistants are increasingly used for code generation, technical documentation, and developer productivity tools. The cross-platform nature of the vulnerability (affecting multiple browser vendors and AI providers) indicates systemic architectural weaknesses in how browser extensions interact with AI assistant contexts.

Historical Context

BragJack represents novel research into an emerging attack surface created by the rapid integration of AI assistants into browser environments. The Prompt Forcing technique disclosed by Weizman appears to be among the first publicly documented attacks specifically targeting the browser extension-to-AI assistant interaction model. The assignment of two CVEs and substantial bug bounty payouts (over $20,000) indicates that major browser and AI vendors recognized this as a previously unidentified vulnerability class. This research follows the broader trend of security researchers examining AI system vulnerabilities, including prompt injection attacks, but specifically focuses on the browser extension vector as an initial access mechanism.

Defensive Recommendations

  • Implement strict isolation between browser extension contexts and AI assistant prompt processing to prevent unauthorized prompt manipulation
  • Deploy extension permission models that explicitly require user consent before extensions can interact with AI assistant interfaces or inject content into AI contexts
  • Monitor for browser extensions requesting excessive permissions related to page content modification, particularly those targeting AI assistant domains or interfaces
  • Establish content security policies (CSP) and same-origin restrictions that limit extension-injected content from reaching AI assistant input channels
  • Conduct regular security audits of AI assistant integration points in browser architectures, focusing on trust boundaries between extension APIs and AI processing pipelines