{"data":{"id":"efd61ba0-6f56-42ef-8ffe-54694fda98ed","title":"BragJack attacks hijack AI browser agents through malicious extensions","summary":"A security researcher demonstrated BragJack, an attack that hijacks AI assistants built into popular browsers by exploiting a single malicious browser extension. The attack abuses browser extensions' ability to manipulate network traffic using declarativeNetRequest (DNR, a feature that lets extensions change how network requests are handled) to intercept communications between AI models and their privileged browser components, potentially allowing attackers to read files, take screenshots, access browsing history, or control the AI agent to perform actions on websites.","solution":"Google and Microsoft have resolved the flaws they were assigned. Specifically, Chrome assigned CVE-2026-0628 ($7,000 bounty) and Microsoft Edge assigned CVE-2026-55945 ($2,500 bounty) to address the vulnerabilities.","labels":["security"],"sourceUrl":"https://www.bleepingcomputer.com/news/security/bragjack-attacks-hijack-ai-browser-agents-through-malicious-extensions/","publishedAt":"2026-09-19T14:56:31.000Z","cveId":null,"cweIds":null,"cvssScore":null,"cvssSeverity":null,"severity":"high","attackType":["supply_chain"],"issueType":"news","affectedPackages":null,"affectedVendors":["Google","Microsoft","Anthropic","Perplexity"],"affectedVendorsRaw":["Google Chrome","Gemini Live","Perplexity Comet","Microsoft Edge","Opera Neon","Claude in Chrome"],"classifierModel":"claude-haiku-4-5-20251001","classifierPromptVersion":"v3","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":null,"epssScore":null,"patchAvailable":null,"disclosureDate":"2026-09-19T14:56:31.000Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity"],"aiComponentTargeted":"api","llmSpecific":true,"classifierConfidence":0.92,"researchCategory":null,"atlasIds":null}}