BragJack · $20K in bounty rewards from Anthropic, Perplexity, Google, Microsoft and Opera
Source Reddit Cybersecurity
Mentions 2 CVEs
Mentioned vulnerabilities
Discussion
BragJack is a security research discovery demonstrating how a single browser extension can hijack internal browser agents across five Chromium-based browsers: Chrome, Comet, Edge, Opera Neon, and Claude in Chrome. The attack leverages the declarativeNetRequest (DNR) API to weaken security headers and redirect JavaScript resources, enabling code execution within privileged browser contexts. This allows access to sensitive capabilities such as local file access, browsing history, camera and microphone, and screenshots without user interaction. The research resulted in two CVEs and $20,000 in bounty rewards from major vendors. The vulnerabilities primarily exploit weaknesses in how these browsers handle network requests and security policies within embedded web views. No patch or remediation status is provided in the source data.
r/cybersecurity (opens in a new tab)u/Content-Winter53280 points0 comments
Hi folks, my name is Gal Weizman, I do browser security research.
Excited to finally share my recent work, where I managed to hack Chrome, Comet, Edge, Opera and Claude in Chrome using one single browser extension
2 CVEs & $20,000 in bounties 🙂
Hope you like it!
https://forever.security/blog/bragjack-attack-hijacks-every-browser-agent