4K3RCM7q9qslk2ZPIwf ZJs8Qev5

Noma Labs discovered an exploit chain in Claude Code Desktop's preview pane that achieves arbitrary file read via unrestricted JavaScript execution. Disguised as a coverage report, the attacker places poisoned HTML in a public repo that bypasses the preview sandbox and runs JavaScript without a Content Security Policy to block it.

The delivery mechanism makes this attack path particularly interesting: a victim clones a public repo and asks Claude to review a file. Claude reads the file, its preview pane renders it automatically, and the embedded malicious payload executes. Because Claude's preview pane loads files above 256KB via file:// URLs, the payload gets same-origin access to the victim's entire local filesystem.

Sensitive credentials and secrets such as API keys, SSH private keys, cloud credentials, Claude's own OAuth tokens, and even the victim's real IP address via WebRTC are silently exfiltrated.

‍ Anthropic scored Noma Labs' discovery as CVSS 8.7 (High) and treated the impact as equivalent to code execution on the host.

What is Claude Code Desktop's Preview Pane?

Claude Code Desktop’s preview pane is a feature most users have used, but few ever consider from a security perspective. Whenever Claude reads or edits an HTML file, the preview pane automatically renders it in an embedded panel so the user can see the result right away.

Under the hood, this preview pane is an artifact renderer that takes HTML content Claude has modified and displays it in the application using Electron's Chromium-based rendering engine. The victim doesn't navigate to a URL or open a file in their browser; instead, the preview pane renders the file automatically. To protect against malicious content, the preview pane runs inside a sandbox where a Content Security Policy (CSP) blocks script execution, origin isolation limits what rendered content can access, and a request filter controls which resources the renderer can fetch. This architecture creates three layers of defense between an HTML file and the victim’s machine. Noma Labs researchers bypassed all three.

Anthropic sandboxes the preview pane with three defenses: a Content Security Policy (CSP) with script-src 'none' that blocks JavaScript execution, data: URL loading that gives the page an opaque origin so it can't fetch local files, and a request filter on the dev server proxy that catches outbound requests from the renderer.

We started by looking at how Claude Code Desktop renders HTML files in the preview pane. Claude’s preview pane renders small and large files differently:

Files under 256KB load as data: URLs, which restrict what embedded scripts can access.

Files over 256KB are written to a temp file and loaded as file:// URLs, which in Chromium can read other local files through fetch() .

A CSP is applied to files rendered in the preview, blocking all inline script execution. But it only covers the data: URL path. The file:// path never receives the CSP, so JavaScript in a large file runs unrestricted. There is also a request filter meant to block file:// reads from the preview. When the preview proxies a running dev server, such as a local React or Node app, the filter is active and blocks those reads. But when it renders a static HTML file directly from disk, like a coverage report, the filter does not engage and fetch() calls resolve against the real filesystem. These three gaps chained together give an attacker arbitrary file read through the preview pane:

Pad the file past 256KB to get a file:// origin

Exploit the missing CSP to run scripts

Use the inactive request filter to read any local path.

Vulnerability Proof of Concept

One Question, Full Compromise

‍ To demonstrate the vulnerability, Noma Labs researchers set up a repository that looked exactly like a normal project, including source files, tests, and a coverage report. Testing tools generate these reports to show which parts of a codebase have coverage. Repos of this type are normally large because they bundle source maps and CSS, so a 500KB report doesn't raise any flags. We made ours over 256KB and embedded a JavaScript payload in it.

A victim clones the repo, opens Claude Code Desktop, and asks it to add a row to the coverage report for a new module.

Claude proposes a clean diff with a filename, line coverage, and branch coverage. It looks like any other one-liner, so the victim approves it.

Once Claude applies the edit, the preview pane renders the file and the payload executes.

The embedded script resolves the victim's directory from the temp file path and starts pulling files via fetch() and XMLHttpRequest:

AWS access keys and secrets

npm and GitHub auth tokens

Kubernetes cluster credentials

Git identity and tokens

Because Claude Code Desktop has no CSP restricting outbound requests, the script sends everything back to the attacker's server using navigator.sendBeacon(), a web API that silently fires a one-way HTTP POST in the background. This exfiltration method works because, as mentioned previously, Claude Code Desktop is an Electron app. Electron apps' entire UI runs on a full Chromium browser engine with access to all standard web APIs. In practical terms, this means the victim doesn't need to approve or grant Claude Desktop access to anything. No permission request is created to ask the victim to review the coverage report or its contents. The original victim's request to Claude to view the coverage report is enough to trigger the preview, execute the payload, and exfiltrate data and secrets. Because Claude renders the untrusted content on the victim's behalf, the rendering step is where the malicious code executes.

‍ After our initial report, Anthropic deployed a patch that blocked fetch() and XMLHttpRequest calls to file:// paths from the main page context. However, Noma Labs researchers found another way around the patch. By moving the fetch() call into a Web Worker created from a blob: URL, we were able to originate the request from a context that the CSP filter did not cover.

The Worker read the same set of sensitive files and sent them back to the main thread, which exfiltrated them via sendBeacon() .All three original defects remained exploitable through this path. ‍

Anthropic took Noma's disclosure seriously from the start. ‍ They triaged the initial report, scored it CVSS 8.7 (High) using CVSS v4.0, and deployed a patch blocking direct fetch() and XMLHttpRequest calls to file:/ / paths from the renderer. ‍ After we submitted the bypass demonstrating that URL Web Workers could circumvent the fix, they confirmed the issue remained unresolved and committed to additional work to address it:

After the final retest, Anthropic fixed all issues; they closed the vulnerability and marked it as resolved.

A sincere thank you to the Anthropic team for their transparent, responsive partnership and relentless persistence throughout this disclosure process. Safely advancing frontier AI requires a model of mutual responsibility in which security researchers and platform vendors collaborate transparently through continuous feedback loops. Anthropic’s dedication to iterating on every bypass until achieving a comprehensive, layered fix exemplifies the collaborative standard needed to protect the broader community.

July, 4, 2026 Initial Report: Vulnerability reported to Anthropic with full PoC demonstrating exfiltration of sensitive credentials via arbitrary JavaScript execution in the file preview pane.

July, 9, 2026 Triage: Anthropic scored the vulnerability CVSS 8.7 (High).

July 24, 2026 Patch and Retest: Anthropic fixed the vulnerability and requested a retest.

July 24, 2026 Bypass Reported: Noma Labs demonstrated that the blob: URL scheme Web Workers bypass the request filter. Full bypass PoC with video walkthrough submitted.

August 3, 2026 Bypass Confirmed: Anthropic confirmed the fix is incomplete and moved the report back to Triaged. Complete fix covering CSP, file:// loading, and the Worker bypass is in progress.

August 17, 2026 Anthropic issued a fix in Claude Desktop 1.30096.1 and later, delivered via auto-update.

October, 2026 GitHub Advisory and CVE pending publish

See how we secure your AI, NOMA-tter what.

Noma enables organizations to discover, govern, test, and protect AI and agents across the enterprise.

Workflow Identity Hijacking: The Silent Backdoor in AI Workflows

RufRoot: The MCP Bridge Vulnerability That Turns Agents Into Rogue Admins (CVE-2026-59726)

GitLost: How We Tricked GitHub’s AI Agent into Leaking Private Repos