BragJack is a proof-of-concept attack leveraging a malicious browser extension to hijack AI assistants in Chrome and Edge via prompt forcing, resulting in over $20,000 in bounties and two CVEs.
Researchers discovered 19 malicious Chrome and Edge browser extensions that steal cryptocurrency wallet secrets, indicating a coordinated campaign.
Google and Microsoft removed the ModHeader browser extension from their stores due to a dormant hidden browsing-history collector found in the official version, with no evidence of active data transmission.