AI Security · Web App Attack

Anthropic Claude Chrome extension security update

Update the Anthropic Claude Chrome extension to the patched version that enforces exact-origin checks for 'claude.ai' and verify Arkose Labs CAPTCHA instances. Anthropic's Claude Chrome extension allowed websites to silently inject prompts.

1 source · Mar 26

Timeline

• Mar 26 Reported by The Hacker News

Sources

• Mar 26 The Hacker News

  Claude Extension Flaw Enabled Zero-Click XSS Prompt Injection via Any Website

  Claude extension flaw enabled silent prompt injection via XSS and weak allowlist, risking data theft and impersonation until Feb 19, 2026 fix.

  original

Part of the PlainSec briefing for 2026-03-26

Every edition of this story: Anthropic Claude Chrome extension security update