Versions below 1.41 of the Claude Chrome extension have a high-risk prompt injection vulnerability and must be upgraded promptly

According to GoPlus citing the Koi report, the Claude Chrome extension under Anthropic has a high-risk prompt injection vulnerability, affecting all versions of the extension below 1.41.

Attackers can construct malicious web pages that silently load an iframe containing a cross-site scripting (XSS) vulnerability in the background and execute malicious payloads within the a-cdn.claude.ai subdomain. Since this subdomain is on the extension's trust whitelist, attackers can directly send malicious prompts to the Claude extension and execute them automatically, without any user authorization or clicks, leaving the victim unaware. This vulnerability can allow attackers to manipulate the Claude extension to read users' Google Drive documents, steal business access tokens, or export chat logs, and can also take over the current browser session to perform sensitive operations like sending emails on behalf of the victim. GoPlus recommends that users immediately update the Claude extension to version 1.41 or above and remain vigilant against phishing links.

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.