BREAKING
Claude for Chrome Flaw Unpatched
How the Attack Works
1
Install malicious extension
↓
2
Run script on claude.ai
↓
3
Fake click, no isTrusted check
↓
4
Claude acts on your accounts
0
CVSS default mode
0
Act without asking
0
Preset tasks abusable
What Attackers Can Reach
Google Services
●
Read recent Gmail
●
Open latest Doc
●
Create Calendar meetings
Salesforce
●
Modify leads
●
Convert to opportunities
Reported in May, Still Live
A Recurring Confused Deputy
AI NEWS BLITZ
A vulnerability in Anthropic's Claude for Chrome extension remains unpatched, researchers say.