AnalysisCybersecuritySeptember 16, 2026

BragJack attack hijacks browser AI assistants via one extension

Forever Security showed a single extension with two common permissions could command the built-in AI in Chrome, Comet, Edge, Opera Neon and Claude in Chrome. On Chrome and Comet it read local files; on Chrome it also enabled camera and microphone. The Chrome flaw, GlicJack (CVE-2026-0628, CVSS 8.8), was fixed in Chrome 143.0.7499.192.

2 sources

More stories today

Open the live feed