Disclosed vulnerability
ShadowPrompt: any website could hijack Anthropic's Claude Chrome extension via an over-broad origin allowlist
AIR-2026-0080 AIR record · 2026-03-anthropic-claude-chrome-shadowprompt
From the supporting source
With JavaScript execution on a-cdn.claude.ai, the final step writes itself. The injected script sends a message to the Claude extension using chrome.runtime.sendMessagekoi.ai
The record
Disclosed
2026-03-26
Vendor
Anthropic
Product
Claude Chrome extension, versions below 1.0.41
Risk domain
Tool misuse › Supply chain vulnerabilities
Also touches
Unsafe actuation, Credential theft, Data exfiltration channels
System type
Generative model
Who acted
Agent acted — any website could drive the extension's browser automation and email send
Attack surface
Browser agent
Autonomy level
Semi-autonomous
Initial vector
Cross origin message injection
Impact type
Agent hijack, Data exfiltration, Credential theft, Unauthorized actions
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI04 – Agentic Supply Chain Vulnerabilities
- MITRE ATLAS
- AML.T0040 – AI Supply Chain Compromise
- NIST AI RMF
- MAP 4.1
- EU AI Act
- Annex III §2
- ISO/IEC
- TR 24028; 42001; 23894
- AIUC-1
- B. Security
- Scope
- tool failure
- Mitigation
- Scan dependencies and container images for vulnerabilities; Use trusted sources.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
All Claude Chrome extension users below 1.0.41
Capability abused
Defense & remediation
Recorded defense
Origin allowlist matching *.claude.ai
Guardrail kinds
Permission scope
Guardrail outcome
Silent
Fix shipped
Patch deployed 2026-01-15; extension now requires exactly https://claude.ai
Taxonomy & references
Curator notes
Author Oren Yomtov. Chained a wildcard origin allowlist with a DOM XSS in an Arkose Labs CAPTCHA component on a-cdn.claude.ai. Disclosed 2025-12-26, confirmed by Anthropic within 24 hours. No CVE listed in the post. | Merged from duplicate id `2026-03-koi-shadowprompt-claude-chrome`. Also reported as: 'ShadowPrompt: zero-click prompt injection chain hijacks Anthropic's Claude for Chrome extension from any website'.
Supporting sources
Cite as
Enkrypt AI. "ShadowPrompt: any website could hijack Anthropic's Claude Chrome extension via an over-broad origin allowlist". AIR, AIR-2026-0080. https://agentincident.vercel.app/i/AIR-2026-0080/ (accessed 2026-10-19).