The security monitoring platform GoPlus issued a high-risk alert on March 27, indicating that the Anthropic Claude Chrome browser extension has a critical prompt injection vulnerability affecting installations below version 1.0.41, impacting over 3 million users. Attackers can read Google Drive documents, steal business tokens, and send emails as the user.
Vulnerability Principle: Two Weaknesses Combine to Form a Complete Attack Chain
This vulnerability consists of a combination of two independent security flaws that create a high-risk attack path.
First Weakness: The overly broad subdomain trust of the Claude Chrome extension’s messaging mechanism allows commands from all *.claude.ai subdomains to pass through, one message type, onboarding_task, directly accepts external prompts to be executed by Claude without finer source validation.
Second Weakness: The DOM-based XSS vulnerability in the Arkose Labs CAPTCHA component. Anthropic uses the third-party CAPTCHA provider Arkose Labs, whose CAPTCHA component is hosted on a-cdn.claude.ai—a subdomain that falls within the *.claude.ai trust scope. Security researchers discovered a DOM-based XSS vulnerability in an older version of the CAPTCHA component: the component never verified the sender’s identity (did not check event.origin) when receiving external messages and rendered user-controllable strings directly as HTML without any sanitization.
Complete Attack Chain: Victim visits a malicious webpage → Background silently loads the Arkose iframe with the XSS vulnerability → Injects malicious payload executed within the a-cdn.claude.ai domain → Exploits the subdomain trust whitelist to send malicious prompts to the Claude extension and executes them automatically. The entire process occurs in an invisible hidden iframe, completely undetectable by the victim.
What Can Attackers Do: Account Taken Over Without Awareness
Once the attack is successful, attackers can perform the following actions on the victim’s account without any user authorization or clicks:
· Steal Gmail access tokens (persistent access to Gmail and contacts)
· Read all documents in Google Drive
· Export complete chat history from Claude
· Send emails as the victim
· Open new tabs in the background, open the Claude sidebar, and execute arbitrary commands
Fix Status and Security Recommendations
The vulnerability has been fully patched: Anthropic patched the Claude Chrome extension on January 15, 2026, allowing requests only from specific sources; Arkose Labs fixed the XSS vulnerability on February 19, 2026, with thorough retesting on February 24, 2026, confirming the issue was resolved. GoPlus’s alert aims to remind users still using older versions to upgrade promptly.
GoPlus offers the following security recommendations: Go to the Chrome browser at chrome://extensions, find the Claude extension, and ensure the version number is 1.0.41 or higher; be cautious of phishing links from unknown sources; AI Agent applications should follow the “least privilege principle”; and introduce a human-in-the-loop mechanism for operations involving high sensitivity.
Frequently Asked Questions
How can I confirm if my Claude Chrome extension version is safe?
Go to the Chrome browser at chrome://extensions, find the Claude extension, and check the version number. If the version is 1.0.41 or higher, the vulnerability has been patched; if it is below 1.0.41, please update or reinstall the latest version immediately.
Does this vulnerability require the user to actively click a malicious link to be triggered?
No, it does not. As long as the user visits the malicious webpage, the attack can execute silently in the background without any clicks, authorizations, or confirmations. The entire attack chain is completed in a hidden iframe, completely undetectable by the victim.
Anthropic has completed the fix, so why is an update still necessary?
Some users may not have enabled automatic updates for the browser extension, resulting in them still using an outdated version below 1.0.41. GoPlus’s alert aims to remind these users to actively check their version and manually upgrade to ensure safety.
Disclaimer: The information on this page may come from third parties and does not represent the views or opinions of Gate. The content displayed on this page is for reference only and does not constitute any financial, investment, or legal advice. Gate does not guarantee the accuracy or completeness of the information and shall not be liable for any losses arising from the use of this information. Virtual asset investments carry high risks and are subject to significant price volatility. You may lose all of your invested principal. Please fully understand the relevant risks and make prudent decisions based on your own financial situation and risk tolerance. For details, please refer to
Disclaimer.
Related Articles
In Q1 2026, Web3 projects suffered losses of over $460 million from hacks and scams, with phishing attacks leading the way.
Hacken’s report shows that in the first quarter of 2026, Web3 projects lost $464.5 million due to hacker attacks and scams, with phishing and social engineering attacks accounting for $306 million in losses. In addition, hardware wallet scams accounted for the bulk of the losses. Moreover, losses were also significant due to smart contract vulnerabilities and access control failures. In terms of regulation, the European legal framework has increased security monitoring requirements.
GateNews1h ago
RAVE’s hype surge triggers a flood of copycat coin mania, as FF and INX expose the “pump-and-dump” scheme
Recently, altcoins represented by RAVE have sparked a fierce investment craze, but some old star projects like FF and INX have used this wave of hype to carry out “pump-and-dump” operations—rapidly driving up coin prices to lure retail investors to buy, and then dumping them heavily, causing the price to plunge rapidly. Such behavior not only exposes the project team’s funding difficulties, but also damages investors’ trust. Investors need to stay alert to signals like abnormal short-term surges in order to avoid the risk of being manipulated by the market.
MarketWhisper4h ago
FBI teams up with Indonesia to dismantle W3LL phishing network, with more than $20 million involved
The U.S. FBI and Indonesian police successfully cooperated to dismantle a W3LL phishing network, seizing related equipment and detaining suspects. The W3LL phishing toolkit offers low-priced fake login pages that use man-in-the-middle attacks to easily bypass multi-factor authentication, forming an organized cybercrime ecosystem. This operation marks cooperation between the U.S. and Indonesia in law enforcement against cybercrime; however, the security threats to cryptocurrency users remain severe.
MarketWhisper8h ago
Squads Emergency Alert: Address poisoning and forged multisig accounts; a whitelist mechanism will go live
Solana ecosystem multi-signature agreement Squads issued a warning, pointing out that attackers launched an address poisoning attack against users by using fake accounts to trick users into making unauthorized transfers. Squads confirmed that there was no loss of funds and emphasized that this is a social engineering attack rather than a protocol vulnerability. To respond, Squads has implemented protective measures such as a warning system, non-interactive account prompts, and a whitelist mechanism. This incident reflects the growing social engineering threats in the Solana ecosystem and has prompted ongoing security reviews.
MarketWhisper8h ago
South Korean “retaliation intermediary” agencies charged USDT to carry out violent crimes, and continued operating even after the main suspect was arrested
South Korea has recently seen multiple “revenge intermediary” organizations that use cryptocurrency as a payment method. They offer intimidation and murder services via Telegram. Even though the main culprit has been arrested, related advertisements are still being posted. Police are investigating more than 50 cases and have arrested about 30 people.
GateNews10h ago
Fake Ledger App on Apple’s App Store Drains Musician’s 5.9 BTC Retirement Fund
A fake Ledger app on Apple's App Store deceived musician Garrett Dutton into losing 5.9 BTC by entering his seed phrase. This case highlights ongoing wallet scams and the exploitation of trust, as the stolen bitcoin was laundered through KuCoin.
CryptoNewsFlash14h ago
