PiunikaWeb’s report correctly identifies the unsettling part of the research: agentic browser features create a route from comparatively ordinary extension privileges to actions that previously sat behind stronger browser boundaries. But its conclusion that all five products have been patched goes further than the public record supports. Forever Security provides a CVE and specific fixed version for Chrome and Edge; for Comet, Opera Neon, and Claude in Chrome, it says the vendors paid bounties but does not identify a fixed version or patch date for the precise flaws described.
For Windows users and IT administrators, the immediate lesson is more mundane—and more actionable—than the AI framing suggests. An extension inventory is now part of the security boundary around browser AI. If Edge’s Copilot can act in tabs, a browser extension that can alter the pages and network responses Copilot trusts deserves the same scrutiny as software with access to internal web applications.
BragJack targets the channel, not the model
Forever Security researcher Gal Weizman published the BragJack research on September 16, describing one extension framework used against five Chromium-based products. The attack did not depend on tricking an AI model with hidden instructions on a web page, commonly called prompt injection. Instead, the extension impersonated or compromised a trusted web page that the browser’s AI component was designed to accept commands from.
That distinction is central. Browser AI agents commonly split work between a cloud-hosted model and a local browser component capable of interacting with tabs, forms, screenshots, files, and—in some implementations—device hardware. The local component must accept instructions from somewhere. Forever Security’s claim is that, in each product, an extension could interfere with the trusted web origin or resource chain and issue commands through that legitimate path.
The technical mechanism relies on two extension capabilities: content scripts, which are intended to modify web pages, and declarativeNetRequest, which can alter how network requests are handled. These are not obscure permissions exclusive to malware. Content scripts underpin many legitimate extensions, while network-request controls are used by content blockers and privacy tools.
Forever Security calls the technique “DiNneR Serving.” In simplified terms, the extension weakens a trusted page’s browser-enforced restrictions and redirects a JavaScript resource that page expects to load. The malicious code then executes in a context trusted by the AI feature, rather than merely in the extension’s own isolated environment.
The issue is therefore not that an AI assistant suddenly grants every extension unrestricted operating-system access. It is that a browser AI feature can have capabilities beyond a normal web page, while its command path may still be exposed to web-origin manipulation. That is a design problem vendors must solve at the boundary between extension APIs, trusted pages, and privileged browser functions.
Edge’s reported flaw had a specific fix, but only after extension installation
The Edge component in Forever Security’s report is identified as “Microsoft Edge Actions,” and the research assigns it CVE-2026-55945. Forever Security says Microsoft corrected the issue in Edge version 150.0.4078.48, released on July 2, 2026. The Hacker News independently reported the same version and described the flaw as a lower-severity CVE than the Chrome issue.
Forever Security says Edge was the most difficult of the five products to compromise because Microsoft had already placed restrictions around the relevant AI control path. The researchers’ proof of concept reportedly combined a weakness in a Microsoft web page that could send prompts to Edge’s AI with extension capabilities that altered the page’s framing and execution constraints.
Microsoft’s current documentation for Browse with Copilot makes clear why an instruction-channel flaw matters. The feature can click, type, scroll, navigate tabs, and take screenshots of the pages it works with. Microsoft says it asks users to supervise certain consequential actions, including email, purchases, reservations, deletions, and activity on higher-risk sites. It also says Copilot cannot access autofill data, saved passwords, or wallet information while browsing.
Those product controls help constrain what the agent can do in a normal session. They do not eliminate the danger of an extension that can make the AI feature receive instructions from an attacker-controlled context. If an attacker can cause the agent to operate as though it were following a legitimate request, supervision prompts and site blocklists become the remaining safeguards rather than the first line of defense.
The CVE’s practical prerequisite should temper alarm without minimizing the finding: the malicious extension must already be installed and active. This is not a drive-by compromise of an unmodified Edge installation. But extension installation is a meaningful attack surface in managed Windows environments, particularly where users can install from both Microsoft Edge Add-ons and the Chrome Web Store, or where third-party software is allowed to deploy extensions.
“Zero click” does not mean “no initial compromise”
Forever Security marks every BragJack demonstration as requiring no further clicks. That phrase has been repeated widely, and technically it means the extension can act without the victim clicking an AI prompt, approving each task, or opening a particular web page after installation.
It does not mean an attacker can remotely activate the attack against arbitrary Edge, Chrome, or Comet users without first clearing the extension-installation hurdle. The Chrome vulnerability record for CVE-2026-0628 explicitly describes an attacker convincing a user to install a malicious extension. Google fixed that flaw in Chrome 143.0.7499.192 in January 2026.
That is still serious. Browser extensions persist across restarts, often receive broad host permissions, and are easy to package as productivity, coupon, PDF, VPN, sidebar, AI, or security tools. Microsoft’s own security team reported in March that malicious AI-themed extensions had harvested browsing telemetry and AI chat material across Chrome and Edge, using ordinary extension behavior and Chrome Web Store distribution. The research did not describe BragJack being used in the wild, but it shows how a hostile extension could potentially use an AI feature as an additional execution and collection layer.
The practical security boundary is therefore earlier than the visible Copilot prompt. It begins with the decision to permit an extension that can read and modify site data or manipulate browser traffic.
The five-product research does not show identical impact
PiunikaWeb’s summary groups the five products together, but Forever Security’s own table shows materially different claimed outcomes. Chrome’s reported weakness allowed access to local files, screenshots, browser-profile data, and camera and microphone controls. Comet was presented as the most extensive case: the researchers said they could read local files, retrieve browsing history, take screenshots, collect profile data, and direct the AI agent to act as the user.
For Edge, Opera Neon, and Claude in Chrome, Forever Security’s stated impact was principally control of the browser agent rather than direct local-file or camera access. That remains a substantial risk when the agent can reach work tabs, cloud applications, email, and authenticated web sessions. Yet it is important not to transpose Chrome’s reported microphone and camera behavior onto Edge: the research table does not claim those capabilities for Microsoft’s browser.
The fix status also differs. Chrome’s CVE-2026-0628 has a documented fixed version, and Edge’s CVE-2026-55945 does as well. For Comet, Opera Neon, and Claude in Chrome, Forever Security lists no CVE identifier and does not state a patched version or date. The researchers say they received bounties of $7,000 from Google, $7,000 from Perplexity, $5,000 from Microsoft, $900 from Opera, and $600 from Anthropic—$20,500 in total, despite the accompanying narrative rounding the total down to “$20,000.”
Bug bounties demonstrate that vendors accepted and rewarded reports; they are not a substitute for release notes telling customers exactly what was changed. Users of Comet, Opera Neon, and Claude in Chrome should update those products, but public reporting has not established which release definitively closes the BragJack paths.
What Windows administrators should do now
For Edge fleets, the response should focus on extension governance rather than disabling every AI feature by default. Microsoft’s extension-management documentation supports allowlists and blocklists, restriction by requested permission, and rules preventing extensions from reading or changing data on specified sites. Those controls are directly relevant to the trust-boundary failure described in BragJack.
A sensible short-term review should include the following:
- Update Microsoft Edge to 150.0.4078.48 or later and verify that managed devices are not pinned below that release.
- Identify extensions with broad “read and change site data” access, especially access set to all sites, and review whether they genuinely require it.
- Treat extensions requesting network-modification capabilities such as
declarativeNetRequestas elevated-risk software, even when their stated purpose is ad blocking or privacy. - Use Edge’s
ExtensionSettingspolicy to prevent extensions from interacting with sensitive internal domains where feasible, including intranet portals, administrative consoles, and identity-management sites. - Consider an allowlist model for privileged or regulated user groups rather than allowing ad hoc extension installation from multiple stores.
- Use Microsoft Defender Vulnerability Management’s browser-extension inventory, where licensed, to locate installed Edge, Chrome, and Firefox extensions, their permissions, versions, users, and affected devices.
Microsoft’s documentation notes that its browser-extension inventory is available for Windows devices and can show requested permissions and a risk assessment. That is useful for triage, but it does not decide whether an extension is safe. The BragJack result is a reminder that a permission can be common, legitimate, and still dangerous in combination with a browser agent that trusts the wrong page.
The Edge vulnerability itself has a published fixed build. The larger problem exposed by BragJack is less tidy: as browsers give AI agents authority to see, click, type, and summarize, extension permissions that once meant “modify a webpage” can become a way to influence a privileged operator inside the browser.