Oren Yomtov
@orenyomtov
Any website could have hijacked Claude's Chrome Extension to steal your Gmail, Drive, and anything else you're logged into.
I found ShadowPrompt - chaining a wildcard origin allowlist with a DOM XSS in a CAPTCHA component to inject user prompts into Claude's chrome extension
I found ShadowPrompt - chaining a wildcard origin allowlist with a DOM XSS in a CAPTCHA component to inject user prompts into Claude's chrome extension
1 21