Claude Extension Flaw Enabled Zero-Click XSS Prompt Injection via Any Website

Cybersecurity researchers have identified a critical vulnerability in Anthropic's Claude Google Chrome Extension that allows malicious websites to silently inject prompts into the AI assistant without user interaction. This flaw could enable attackers to trigger harmful or deceptive prompts by simply visiting a compromised webpage, posing significant security and privacy risks. The discovery underscores the importance of rigorous security assessments for browser extensions that integrate AI models, especially as they become more widely adopted for sensitive tasks.