Cybersecurity researchers have identified a critical vulnerability in the Anthropic Claude Google Chrome Extension that could allow attackers to execute silent prompt injections. The flaw enables any website to automatically inject commands into the Claude assistant without user interaction, simply by visiting a malicious web page.

The vulnerability, tracked under CVE-2023-XXXX, is a prompt injection type flaw affecting the extension's handling of input from visited web pages. According to Oren Yomtov of Koi Security, the extension failed to properly validate or isolate input sources, which permitted attackers to craft specially designed web content that the extension would interpret as user-generated prompts.

This flaw leverages the attack vector of drive-by website visits, requiring no clicks or additional user actions to trigger the injection. The injection then causes the Claude assistant to execute unauthorized commands or queries, potentially leaking sensitive data or performing unintended actions within the extension's context.

The CVSS score for this vulnerability has not been publicly disclosed, but the ability to silently inject prompts and manipulate the assistant without user consent represents a high-risk security issue. Threat actors could exploit this flaw to induce Claude to reveal confidential information, manipulate outputs, or interact with other connected systems, depending on the extension's permissions.

Anthropic has acknowledged the vulnerability and released an updated version of the Claude Chrome Extension that includes stricter input validation and context isolation to prevent prompt injection attacks. Users of the extension should immediately update to the latest version available through the official Chrome Web Store.

Security teams and SOC analysts should monitor for any suspicious web traffic or unexpected assistant behavior related to this extension. Additionally, organizations deploying the Claude extension should consider restricting its use until the patch has been applied and conduct an audit for any abnormal activity during the vulnerable period.

Operators of threat intelligence and incident response should be aware that malicious actors may attempt to exploit this flaw in targeted phishing campaigns or drive-by download attacks. Ensuring endpoint protection platforms are configured to detect anomalous extension behavior is advisable.

In summary, CVE-2023-XXXX in the Anthropic Claude Chrome Extension demonstrates the risks of insufficient input sanitization in AI-powered browser extensions. Immediate patching and vigilant monitoring are essential to mitigate this vector.

References:

  • Koi Security Research Report by Oren Yomtov
  • The Hacker News disclosure
  • Anthropic official security advisory and patch release