September 17, 2026
One Extension Hijacks the AI Assistant in Five Major Browsers
BragJack hijacked built-in AI assistants in five major browsers (Chrome, Microsoft Edge, Opera Neon, Perplexity Comet, and Claude in Chrome) from a single malicious extension, with no guardrail bypass or prompt injection required. Spain's data protection agency received the first personal-data breach notification blaming an AI agent for autonomous execution of the intrusion, including file searches, lateral movement, and data exfiltration. CVE-2026-59310 in VMware vCenter, a directory traversal enabling unauthenticated RCE, is now actively exploited in ransomware campaigns with over 360 compromised servers identified. Multiple critical vulnerabilities including CVE-2026-84869 in ConnectWise ScreenConnect, CVE-2026-5430 in WSO2 API Manager, and CVE-2026-58704 in Google Pixel are under active exploitation by threat actors.