AI · 219 days ago

Anthropic Claude Chrome extension security update

Update the Anthropic Claude Chrome extension to the patched version that enforces exact-origin checks for 'claude.ai' and verify Arkose Labs CAPTCHA instances. Anthropic's Claude Chrome extension allowed websites to silently inject prompts.

Timeline

• Mar 26 Reported by The Hacker News

Sources

1 source covering this story

• The Hacker News Mar 26

  Claude Extension Flaw Enabled Zero-Click XSS Prompt Injection via Any Website

  Claude extension flaw enabled silent prompt injection via XSS and weak allowlist, risking data theft and impersonation until Feb 19, 2026 fix.

Part of the PlainSec briefing for 2026-03-26

Editions

• Briefing for 2026-03-26