Claude Extension Flaw Enabled Zero-Click XSS Prompt Injection via Any Website
A flaw in Anthropic's Claude Google Chrome Extension has been found by cybersecurity researchers. This flaw might have been used to cause harmful prompts to appear just by visiting a website.
According to a study provided with The Hacker News by Koi Security researcher Oren Yomtov, the vulnerability allowed any website to quietly insert prompts into that assistance as if the user wrote them. "No permission requests, no clicks. An attacker can take full control of your browser by simply visiting a page.
The problem, known as ShadowPrompt, has two fundamental defects:
Any subdomain that matched the pattern (*.claude.ai) might submit a prompt to Claude for execution due to an excessively liberal origin allowlist in the extension.
A cross-site scripting (XSS) vulnerability based ...