A critical zero-click vulnerability in Anthropic’s Claude Chrome Extension exposed over 3 million users to silent prompt-injection attacks, allowing malicious websites to hijack the AI assistant without user interaction.

The flaw, now patched, could have enabled attackers to steal Gmail access tokens, read Google Drive files, export chat history, and send emails all invisibly.

The exploit chained uncovered by KOI security contains two distinct flaws to achieve full browser takeover. The first was an overly permissive origin allowlist in the Claude extension itself.

The extension’s messaging API accepts a message type called onboarding_task, which accepts a prompt parameter and forwards it directly to Claude for execution.

Critically, the extension validated only that the message originated from any *.claude.ai subdomain a wildcard that proved catastrophically broad.

The second flaw resided in a third-party component. Anthropic uses Arkose Labs for CAPTCHA verification, with challenge components hosted on a-cdn.claude.ai a first-party subdomain. Because this matched the *.claude.ai wildcard, the extension granted it full messaging permissions identical to claude.ai itself.

Researchers then discovered that the Arkose CDN still served older, versioned CAPTCHA game components at predictable URLs. One such older version, brute-forced by walking backward through version numbers, contained a DOM-based XSS vulnerability built from two compounding mistakes.

First, it was accepted postMessage data from any parent origin without validating event.origin. Second, it rendered a user-controlled stringTable field as raw HTML using React’s dangerouslySetInnerHTML with no sanitization.

The Full Exploit Chain

An attacker could embed the vulnerable Arkose component inside a hidden