Security Flaw Found in Claude Chrome Extension

A critical vulnerability has been identified in the Claude Chrome extension, affecting versions below 1.41. According to ChainCatcher, GoPlus cited a report from Koi highlighting this issue. The flaw allows attackers to exploit malicious web pages that silently load iframes containing cross-site scripting (XSS) vulnerabilities. These can execute harmful payloads within the a-cdn.claude.ai subdomain, which is on the extension's trusted whitelist. This enables attackers to send and automatically execute malicious prompts to the Claude extension without user consent or interaction, leaving victims unaware. The vulnerability could allow attackers to manipulate the Claude extension to access users' Google Drive documents, steal business access tokens, or export chat logs. Additionally, it could enable the takeover of current browser sessions to perform sensitive actions, such as sending emails, impersonating the victim. GoPlus advises users to update the Claude extension to version 1.41 or higher immediately and to remain vigilant against phishing links.