Claude Chrome Extension Flaw Enabled Zero-Click Prompt Injection via Trusted Subdomain XSS

Researchers disclosed a critical zero-click vulnerability chain in Anthropic’s Claude Chrome extension that allowed a malicious website to inject prompts into the AI assistant without any user interaction. The attack relied on the extension trusting any *.claude.ai origin and a DOM-based XSS flaw in an older Arkose Labs CAPTCHA component hosted on a-cdn.claude.ai; by loading the vulnerable component in a hidden iframe and sending a crafted postMessage, attacker-controlled JavaScript could appear to come from a trusted Claude origin and submit prompts as the victim.

Successful exploitation could have exposed more than 3 million users to account and data compromise, including theft of Gmail OAuth tokens, access to Gmail, Google Drive, and Claude chat history, and invisible actions such as sending emails on the user’s behalf. KOI Security researcher Oren Yomtov reported the issue to Anthropic in late December 2025, Anthropic patched the extension by tightening origin validation to https://claude.ai in January 2026, and Arkose Labs separately fixed the XSS issue in February 2026 after the vulnerable resource was disabled.