BragJack Prompt Forcing: Defending AI Browser Agents Against Malicious Extension Hijacking

---
title: Browser Launched With Extension Sideloading Flags
id: 3f8c2a71-9b4d-4e6f-a1c2-7d5e8f0a1b3c
status: experimental
description: Detects Chrome, Edge, or Chromium-based AI browsers launched with flags that load unpacked/sideloaded extensions or suppress extension security prompts. Sideloading is the primary delivery path for malicious extensions used in BragJack-style AI agent hijacking.
references:
  - https://www.bleepingcomputer.com/news/security/bragjack-attacks-hijack-ai-browser-agents-through-malicious-extensions/
  - https://attack.mitre.org/techniques/T1176/
author: Security Arsenal
date: 2026/02/10
tags:
  - attack.persistence
  - attack.t1176
logsource:
  category: process_creation
  product: windows
detection:
  selection_browser:
    Image|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\opera.exe'
      - '\neon.exe'
      - '\comet.exe'
  selection_flags:
    CommandLine|contains:
      - '--load-extension'
      - '--disable-extensions-except'
      - '--disable-component-extensions-with-background-pages'
      - '--allowlisted-extension-id'
  condition: selection_browser and selection_flags
falsepositives:
  - Legitimate extension developers and QA teams (scope by user/hostname)
  - Enterprise automation frameworks that load helper extensions
level: high
---
title: Browser Extension Force-Install Policy Tampering
id: 8a1d4e52-6c3b-4f7a-b2d9-1e4c7a0f3b6d
status: experimental
description: Detects registry modification of Chrome/Edge ExtensionInstallForcelist or extension settings policies. Adversaries use force-install policies to silently deploy malicious extensions capable of hijacking AI browser agents, bypassing user consent entirely.
references:
  - https://www.bleepingcomputer.com/news/security/bragjack-attacks-hijack-ai-browser-agents-through-malicious-extensions/
  - https://attack.mitre.org/techniques/T1176/
author: Security Arsenal
date: 2026/02/10
tags:
  - attack.persistence
  - attack.privilege_escalation
  - attack.t1176
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|contains:
      - '\Policies\Google\Chrome\ExtensionInstallForcelist'
      - '\Policies\Microsoft\Edge\ExtensionInstallForcelist'
      - '\Policies\Google\Chrome\ExtensionInstallAllowlist'
      - '\Policies\Microsoft\Edge\ExtensionInstallAllowlist'
      - '\Policies\Google\Chrome\ExtensionInstallBlocklist'
      - '\Policies\Microsoft\Edge\ExtensionInstallBlocklist'
falsepositives:
  - Legitimate GPO/MDM policy deployment (correlate with change management; alert on values pushed by non-SYSTEM, non-MDM processes)
level: high
---
title: Extension Manifest Written Outside Managed Store Path
id: 2c7b9f14-5a8e-4d1c-9e3b-6f0a2d8c4e7b
status: experimental
description: Detects creation of a browser extension manifest.json in user-writable directories outside the managed extension store cache, indicating a developer-mode or unpacked extension deployment consistent with BragJack delivery.
references:
  - https://www.bleepingcomputer.com/news/security/bragjack-attacks-hijack-ai-browser-agents-through-malicious-extensions/
  - https://attack.mitre.org/techniques/T1176/
author: Security Arsenal
date: 2026/02/10
tags:
  - attack.persistence
  - attack.t1176
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|endswith: '\manifest.json'
  filter_store:
    TargetFilename|contains:
      - '\AppData\Local\Google\Chrome\User Data\Default\Extensions\'
      - '\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\'
  condition: selection and not filter_store
falsepositives:
  - Web developers working on local extension or web app projects (tune by excluding known dev paths such as node_modules and source repos)
level: medium

let AIDomains = dynamic(["copilot.microsoft.com", "claude.ai", "api.anthropic.com", "perplexity.ai", "gemini.google.com", "edgeservices.bing.com"]);
let SideloadedExt =
    DeviceFileEvents
    | where TimeGenerated > ago(7d)
    | where FileName =~ "manifest.json"
    | where FolderPath has_any ("\\Google\\Chrome\\", "\\Microsoft\\Edge\\", "\\Opera\\", "\\Comet\\")
    | where FolderPath !has "\\Extensions\\"  // outside store-managed cache = unpacked/dev-mode
    | project DeviceName, TimeGenerated, FolderPath, InitiatingProcessFileName, InitiatingProcessAccountName;
let SuspiciousLaunch =
    DeviceProcessEvents
    | where TimeGenerated > ago(7d)
    | where FileName in~ ("chrome.exe", "msedge.exe", "opera.exe", "comet.exe")
    | where ProcessCommandLine has_any ("--load-extension", "--disable-extensions-except")
    | project DeviceName, LaunchTime=TimeGenerated, ProcessCommandLine, AccountName;
SideloadedExt
| join kind=inner SuspiciousLaunch on DeviceName
| extend PossibleBragJackPrecondition = "Sideloaded extension + extension-loading browser flags"
| join kind=leftouter (
    DeviceNetworkEvents
    | where TimeGenerated > ago(7d)
    | where RemoteUrl has_any (AIDomains)
    | project DeviceName, AITrafficTime=TimeGenerated, RemoteUrl, InitiatingProcessFileName
) on DeviceName
| summarize ExtensionPaths = make_set(FolderPath), Launches = make_set(ProcessCommandLine), AIEndpoints = make_set(RemoteUrl)
    by DeviceName, InitiatingProcessAccountName
| extend Severity = iff(isnotempty(AIEndpoints), "High", "Medium")
| sort by Severity asc;

-- BragJack Triage: Enumerate Chromium extension installs and flag non-store extensions
LET profiles = SELECT FullPath
FROM glob(globs='C:/Users/*/AppData/Local/*/User Data/*/Extensions/*/*',
          accessor='ntfs')

LET unpacked = SELECT FullPath AS ManifestPath,
       Mtime AS LastModified
FROM glob(globs='C:/Users/*/AppData/Local/{Google/Chrome,Microsoft/Edge}/User Data/*/Local Extension Settings/**', accessor='ntfs')

LET suspect_manifests = SELECT FullPath AS ManifestPath, Mtime AS LastModified
FROM glob(globs='C:/Users/*/**/manifest.json', accessor='ntfs')
WHERE ManifestPath !~ 'Extensions'
  AND ManifestPath !~ 'node_modules'
  AND ManifestPath =~ 'manifest.json$'

SELECT * FROM suspect_manifests
UNION ALL
SELECT FullPath AS ManifestPath, Mtime AS LastModified
FROM profiles
WHERE LastModified > now() - 604800000000000  -- modified in last 7 days

# BragJack defensive audit: enumerate Chromium extensions and flag non-allowlisted installs
$ApprovedExtensionIds = @('YOUR-APPROVED-ID-1','YOUR-APPROVED-ID-2')  # populate from your software inventory

$browserExtPaths = @(
    "$env:LOCALAPPDATA\Google\Chrome\User Data\Default\Extensions",
    "$env:LOCALAPPDATA\Microsoft\Edge\User Data\Default\Extensions",
    "$env:APPDATA\Opera Software\Opera Stable\Extensions"
)

# Also audit all user profiles on multi-user systems
$allProfiles = Get-ChildItem 'C:\Users' -Directory -ErrorAction SilentlyContinue
foreach ($p in $allProfiles) {
    $browserExtPaths += "$($p.FullName)\AppData\Local\Google\Chrome\User Data\Default\Extensions"
    $browserExtPaths += "$($p.FullName)\AppData\Local\Microsoft\Edge\User Data\Default\Extensions"
}

$report = foreach ($path in $browserExtPaths) {
    if (Test-Path $path) {
        Get-ChildItem $path -Directory -ErrorAction SilentlyContinue | ForEach-Object {
            $extId = $_.Name
            $latest = Get-ChildItem $_.FullName -Directory | Sort-Object LastWriteTime -Descending | Select-Object -First 1
            [PSCustomObject]@{
                ExtensionId     = $extId
                Path            = $_.FullName
                LastModified    = $latest.LastWriteTime
                Allowlisted     = ($ApprovedExtensionIds -contains $extId)
            }
        }
    }
}

# Flag: any extension not on the allowlist warrants review; recently modified ones are highest priority
$report | Where-Object { -not $_.Allowlisted } |
    Sort-Object LastModified -Descending |
    Format-Table -AutoSize

# Audit force-install and blocklist policies for tampering
$policyKeys = @(
    'HKLM:\SOFTWARE\Policies\Google\Chrome\ExtensionInstallForcelist',
    'HKLM:\SOFTWARE\Policies\Microsoft\Edge\ExtensionInstallForcelist',
    'HKLM:\SOFTWARE\WOW6432Node\Google\Chrome\Extensions',
    'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Edge\Extensions'
)
foreach ($key in $policyKeys) {
    if (Test-Path $key) {
        Write-Host "`n[POLICY] $key" -ForegroundColor Yellow
        Get-ItemProperty $key | Format-List
    }
}

# Check for developer-mode / unpacked extension indicators in Chrome Preferences
$prefFiles = Get-ChildItem 'C:\Users\*\AppData\Local\Google\Chrome\User Data\Default\Preferences' -ErrorAction SilentlyContinue
foreach ($pref in $prefFiles) {
    $json = Get-Content $pref.FullName -Raw | ConvertFrom-Json -ErrorAction SilentlyContinue
    if ($json.extensions.settings) {
        $json.extensions.settings.PSObject.Properties | ForEach-Object {
            if ($_.Value.location -eq 4 -or $_.Value.path -notmatch 'Extensions') {
                Write-Host "[SUSPICIOUS] Unpacked/dev-mode extension $($_.Name) in $($pref.FullName)" -ForegroundColor Red
            }
        }
    }
}