Versions below 1.0.41 of the Claude Chrome extension contain a high-risk vulnerability. Please update promptly.

CycleProphet · 2026-03-27T06:45:48+00:00

On March 27, the report indicated that Anthropic's Claude Chrome extension has a high-risk prompt injection vulnerability affecting versions prior to 1.0.41. Attackers can execute malicious actions unnoticed through malicious web pages, steal user information, and users are advised to update the extension promptly and be cautious of phishing links.

CycleProphet

2026-03-27 06:45:48

Abstract generation in progress

According to a TechFlow report on March 27, citing Koi, the Claude Chrome extension under Anthropic has a high-risk prompt injection vulnerability, affecting all versions of the extension below 1.0.41.

Attackers can construct malicious web pages that silently load an iframe containing a cross-site scripting (XSS) vulnerability in the background, executing malicious payloads within the a-cdn.claude.ai subdomain. Since this subdomain is on the extension’s trusted whitelist, attackers can directly send malicious prompts to the Claude extension and execute them automatically, all without user authorization or any clicks, leaving victims unaware.

This vulnerability can allow attackers to control the Claude extension to read users’ Google Drive documents, steal business access tokens, or export chat logs, and can also take over the current browser session to perform sensitive actions like sending emails on behalf of the victim.

GoPlus recommends that users immediately update the Claude extension to version 1.0.41 or above, while also being cautious of phishing links.

View Original

This page may contain third-party content, which is provided for information purposes only (not representations/warranties) and should not be considered as an endorsement of its views by Gate, nor as financial or professional advice. See Disclaimer for details.

1 Likes