BragJack: How We Hijacked 5 Of The World's Most Popular Browsers Using Their Built-In AI Assistants

Executive Summary We just hacked 5 of the world’s most popular browsers using a brand-new technique that relies on AI. And we don’t mean “some AI hacking model that we trained”. No no no… we mean the browser’s own built-in AI assistants that you probably have installed right now. Yes, if you’re using Google Chrome, Microsoft Edge, Opera Neon, Perplexity Comet, or Claude in Chrome… that means you. The interesting thing is that we didn’t even have to bypass the AI’s guardrails to do it. In fact, we didn’t even use prompt injection, because we discovered something worse. All the vulnerabilities we discovered shared the same critical design flaw, and totaled tens of thousands of dollars in bounties from Google, Anthropic, Microsoft, Perplexity, and Opera. We’re calling this research BragJack - and in this blog we’ll walk through: How we found each browser’s vulnerability What they enable attackers to do The scary implications this has on how you need to secure your endpoints. Affected Browsers And What We Could Do To Them Impact \ BrowserChromeCometEdgeOpera NeonClaude in ChromeCVEs discoveredCVE-2026-0628CVE-2026-55945Local file access✅✅❌❌❌Microphone & camera access✅❌❌❌❌Browser agent hijack❌✅✅✅✅Browser profile leak✅✅❌❌❌User history leak❌✅❌❌❌Screenshot ability✅✅❌❌❌Zero clicks required✅✅✅✅✅Bounty$7,000$7,000$5,000$900$600 Read the technical blog here Here’s how we did it: Hacking Google Chrome (By Accident) Everything started on an otherwise normal day a few months ago. I was using Google Chrome when an interesting button appeared in my browser, one you have probably seen before. Google had just added its AI assistant into every Chrome user’s browser. First thought: “cool”. Second thought: “There’s no way in hell this is safe”. So I spent the day trying to break it. And soon enough, I found something pretty scary. Turns out this agent basically has two parts - a body, and a brain. The body is the part that can take actions on your machine - it can screenshot your tabs, turn on your camera and microphone, see your user data… It’s built into the Chrome Browser. The brain is the part that tells it what to do. That’s Google’s Gemini AI, and it doesn’t live inside the browser, but rather on the internet. Basically, every time you ask Gemini to do something in the side panel - it contacts the AI on Google’s servers (that’s the brain), which passes the instructions to be executed on your machine by the body. So, I had a thought - “Is it possible to trick the AI brain …