Versions of ClaudeChrome extensions below 1.41 have a high-risk prompt word injection vulnerability that must be upgraded in time

GoPlus quoted Koi as saying that Anthropic's ClaudeChrome extension has a high-risk alert word injection vulnerability that affects all extensions below version 1.41. An attacker could construct a malicious web page, silently load an iframe with a cross-site scripting (XSS) vulnerability in the background, and execute a malicious payload in the a-cdn.claude.ai subdomain. Since the subdomain is in the trust white list of the extension program, the attacker can directly send malicious prompt words to Claude extension and execute them automatically. The whole process does not require user authorization or any click operation, and the victim is unaware. The vulnerability could allow an attacker to manipulate the Claude extension to read user GoogleDrive documents, steal business access tokens or export chat logs, and could use it to take over current browser sessions and perform sensitive operations such as sending emails as victims. GoPlus recommends that users immediately update the Claude extension to version 1.41 or above, while being wary of phishing links.