Issue 9 3 min read

Treat extension allowlists as agent policy

Built-in browser AI agents reopen a path browsers spent years closing. A low-privilege extension can seize the vendor page the agent trusts and drive a high-privilege body that reads files, takes screenshots, or acts as the user.

On September 16, Forever Security published BragJack. Researcher Gal Weizman showed one ordinary extension hijacking AI assistants across Gemini Live in Chrome, Perplexity Comet, Microsoft Edge, Opera Neon, and Claude in Chrome. The Hacker News covered the same day. This was research and demo work, not a wild campaign. It still needed the victim to install the extension. That is the same starting point as many browser attacks. The operator lesson is sharper than the demo, and it travels with every new in-browser agent.

These products share a design. The agent has a body inside the browser that can see tabs, open files, use camera or mic, or click as the user. The brain runs on vendor servers and tells the body what to do. The body only accepts orders from one trusted vendor page. Extensions are not supposed to command the browser. They are supposed to edit websites. BragJack seized the trusted page and spoke as the vendor.

The extension needed two common powers: content scripts and declarativeNetRequest. Together they inject code into the brain page or rewrite traffic so the page loads attacker script instead of the vendor’s. That is not classic prompt injection. Forever Security calls it Prompt-Forcing: full control of the instruction, the timing, and the follow-ups. EDR that watches for malicious binaries sees an approved agent doing allowed things in plain language.

Chrome was the first chapter. Weizman published GlicJack earlier. Google fixed it in Chrome 143.0.7499.192 as CVE-2026-0628, scored 8.8 by CISA. Impact included file read, camera and mic, and screenshots. Edge was harder. Microsoft blocked the simple path, so Forever Security chained a marketing page that could send prompts with a Think/Do race condition. That became CVE-2026-55945, fixed in Edge 150.0.4078.48. Opera Neon was easiest: opera.com did not block extension scripts on the brain page. Claude in Chrome was mildest: extension-on-extension, medium severity at Anthropic, next to earlier related reports from LayerX and Manifold.

Comet was the worst case. Perplexity gave the agent broad browser powers, then blocked extensions on the main domain. A leftover testing.perplexity.com origin still sat in the trust list. DeclarativeNetRequest defeated the redirect that kept users off that page. Once the testing brain loaded, the extension drove full agent control: file read, history, screenshots, act-as-user. Bounties across the five products totaled about $20,500. As of September 16 neither CVE was on CISA’s Known Exploited Vulnerabilities list, and no public in-the-wild use was claimed.

Issue 7 was registries as a publish surface. Issue 8 was agent-facing docs as install policy. Issue 9 is the endpoint and browser control plane. Putting an agent inside the browser reopens extension-to-privileged-action paths. Your extension allowlist is now agent egress policy.

Inventory these moves before the next fleet rollout:

  1. List which machines run browser-embedded AI agents and who may install extensions there.
  2. Treat extension allowlists as agent policy: pin or allowlist; block broad content-script plus declarativeNetRequest combos on agent brain origins where the product allows it.
  3. Enforce patch floors: Chrome at or above 143.0.7499.192; Edge at or above 150.0.4078.48; force updates on Comet, Opera Neon, and Claude in Chrome, then re-check vendor advisories.
  4. Separate machines or profiles where an agent may act from high-sensitivity finance and admin browsing. Do not run both in the same profile.
  5. Log which page or extension caused agent actions when the product exposes it, so a Prompt-Forcing chain has an owner to page.
  6. Ban leftover test and staging origins from agent trust lists. Comet’s testing domain is the pattern to hunt.

A low-privilege extension should never speak as the vendor brain. If your allowlist ignores that, the body will still obey.

Sources

Next issue in two days. See you then.

Subscribe