Critical Flaw in Claude Chrome Extension Exposes Millions to Silent Browser Takeover Attacks

CyberDefender 11 mins0

A critical security weakness was identified in the Chrome extension of Anthropic’s Claude assistant, a browser-based AI tool used by millions. The issue enabled malicious websites to inject hidden instructions directly into the assistant without any user interaction. This effectively allowed attackers to operate the browser as if they were the user.

The attack combined two separate flaws: an overly broad trust configuration in the extension and a cross-site scripting (XSS) vulnerability in a CAPTCHA component served through a Claude-associated domain. When chained together, these issues created a powerful exploitation path that required no clicks, permissions, or visible indicators.

Users running versions earlier than 1.0.41 were exposed to this risk.

Fake Claude Extension

Background: The Rise of Browser-Based AI Assistants

AI assistants embedded in browsers are becoming increasingly powerful. Claude’s Chrome extension allows users to:

  • Read and summarize web pages
  • Execute JavaScript
  • Interact with websites
  • Automate tasks across tabs

With over three million users, this tool essentially acts as an autonomous agent inside the browser. However, this level of capability also makes it an attractive target for attackers.

Technical Overview of the Vulnerability

Root Cause

The attack relied on two key weaknesses:

  1. Wildcard Trust Model (*.claude.ai)
  2. DOM-Based XSS in CAPTCHA Component

Individually, these might seem manageable. Together, they created a full browser compromise scenario.

Attack Chain Breakdown

1. Overly Permissive Messaging System

The Claude extension uses Chrome’s messaging API:

chrome.runtime.sendMessage()

One specific message type stood out:

onboarding_task

This function accepts a prompt parameter and sends it directly to Claude for execution. The problem? There was no strict validation of where the message came from.

Any page hosted under:

*.claude.ai

was automatically trusted.

2. Third-Party CAPTCHA Component Exposure

Arkose Labs provides CAPTCHA services used by Claude. These challenges are hosted on:

a-cdn.claude.ai

Even though this is third-party code, it resides under the trusted wildcard domain. That means it inherits the same privileges as the main Claude site.

3. Vulnerable Legacy Version Discovery

A versioned CAPTCHA asset was identified:

/fc/assets/ec-game-core/game-core/1.26.0/standard/index.html

By iterating through older versions, a legacy instance was discovered that still contained exploitable code.

4. DOM-Based XSS Vulnerability

The vulnerability stemmed from two unsafe practices:

A. Unvalidated postMessage Handling

window.addEventListener("message", function(event) {
    // event.origin is NEVER checked
    if (event.data.message === "assign_session_data") {
        // Attacker-controlled stringTable gets merged into app state
    }
});

The component blindly trusted messages from any origin.

B. Unsafe HTML Rendering

var kn = React.forwardRef(function(e, t) {
    return React.createElement('div', {
        dangerouslySetInnerHTML: { __html: e.children }
    });
});

User-controlled input was rendered directly as HTML using dangerouslySetInnerHTML, without sanitization.

5. Exploitation

An attacker could inject malicious HTML such as:

<img src=x onerror="malicious_script()">

This script executes in the context of:

a-cdn.claude.ai

6. Final Payload Execution

Once JavaScript execution is achieved, the attacker sends a message to the extension:

chrome.runtime.sendMessage(
  'fcoeoabgfenejglbffodgkkbkcdhcgfn',
  {
    type: 'onboarding_task',
    payload: { prompt: 'ATTACKER_CONTROLLED_PROMPT' }
  }
);

The extension accepts the request and executes it as if it were initiated by the user.

Impact Assessment

This vulnerability effectively grants attackers full control over the victim’s browser session.

Potential Actions

  • Extract Gmail access tokens
  • Read Google Drive files
  • Access Contacts
  • Export chat history
  • Send emails impersonating the user
  • Open hidden background tabs
  • Trigger actions via Claude sidebar

All of this occurs silently, without user awareness.

Attack Characteristics

AttributeDescription
User InteractionNone required
VisibilityInvisible (iframe-based)
PersistencePossible via token theft
Privilege LevelFull browser context
Attack VectorWeb-based

Indicators of Compromise (IOCs)

  • Suspicious messages sent via: chrome.runtime.sendMessage
  • Unauthorized usage of: onboarding_task
  • Malicious payloads injected through: postMessage
  • Exploitation domain: a-cdn.claude.ai
  • Extension ID: fcoeoabgfenejglbffodgkkbkcdhcgfn
  • Hidden iframe execution patterns
  • Unexpected browser automation behavior

Proof of Concept Behavior

The exploit runs entirely inside an invisible iframe. A malicious site embeds the vulnerable CAPTCHA component and sends a crafted postMessage payload. Once triggered:

  1. XSS executes
  2. JavaScript sends a prompt to Claude
  3. Claude performs attacker-defined actions

The user sees nothing.

Mitigation and Fixes

Anthropic’s Response

  • Enforced strict origin validation: https://claude.ai
  • Released patched extension version 1.0.41

Arkose Labs’ Response

  • Removed vulnerable legacy versions
  • Fixed XSS issue
  • Restricted access (returns HTTP 403)

Disclosure Timeline

  • Dec 26, 2025 – Vulnerability reported
  • Dec 27, 2025 – Confirmed by Anthropic
  • Jan 15, 2026 – Patch released
  • Jan 18, 2026 – Fix verified
  • Jan 29, 2026 – Issue reopened (XSS still active)
  • Feb 3, 2026 – Reported to Arkose Labs
  • Feb 19, 2026 – XSS fixed
  • Feb 24, 2026 – Final verification complete

Recommendations

  • Update Claude extension to v1.0.41 or later
  • Audit browser extensions across environments
  • Restrict wildcard trust policies
  • Validate all postMessage origins
  • Avoid rendering unsanitized HTML
  • Monitor unusual browser automation behavior

Our Analysis and Perspective

What makes this case particularly concerning is not just the vulnerability itself, but what it represents for the future of browser security. We are moving into a world where browser extensions are no longer passive tools—they are active agents capable of making decisions, executing code, and interacting with sensitive user data. Claude is a perfect example of this shift.

The real issue here lies in the trust model. By allowing any subdomain under *.claude.ai to communicate freely with the extension, the system assumed that all associated infrastructure was equally secure. That assumption turned out to be flawed. Modern web ecosystems rely heavily on third-party integrations, and each integration expands the attack surface. In this case, a CAPTCHA provider became the weakest link.

Another important takeaway is how legacy systems continue to pose risks. The vulnerability was not in the latest version of the CAPTCHA component, but in an older one that was still accessible. This highlights a recurring problem in security: outdated assets are often forgotten but remain exploitable.

The attack itself is elegant in its simplicity. No phishing, no malware downloads, no user interaction. Just visiting a webpage was enough. That’s a dangerous evolution. It lowers the barrier for attackers and increases the likelihood of mass exploitation.

From a defensive standpoint, this incident reinforces the importance of strict origin validation and least-privilege design. Trust should never be broad by default. Every communication channel must be explicitly verified.

It also raises questions about how we evaluate AI tools. As these assistants gain deeper access to our digital lives, they must be treated with the same level of scrutiny as operating systems or enterprise software. Security cannot be an afterthought.

Ultimately, this vulnerability is a warning. AI-powered browser tools are incredibly useful, but they also introduce new classes of risk. Organizations and users alike need better visibility into what these tools can do—and what could happen if they are compromised.

CyberDefender