Claude Flaw Lets Browser Extensions Execute Code on PCs, Anthropic Has Left It Unfixed ...

A flaw in Anthropic's Claude products allows any browser extension capable of controlling Claude Dispatch to make Claude Desktop execute code on a PC, or even on another computer connected to the same Claude account. Anthropic is aware of the vulnerability but is in no hurry to fix it, The Register reports , citing security researcher Gal Weizman.

Exploiting the vulnerability does not require a browser exploit, and user interaction is minimal. According to the researcher, Anthropic has known the issue since May 2027 but has taken no steps to address it.

Dispatch allows Claude Desktop users to send tasks to their PCs and manage them from a phone or browser. The Forever Security researcher discovered that the Claude Dispatch interface and API are accessible through a regular web session on claude.ai. As a result, a browser extension capable of controlling Claude.ai can send commands to Claude Desktop as though they came from the Dispatch user.

"This extension was able to perform a classic privilege escalation. Because Claude now has access to files in the operating system, it can execute code in the operating system and completely compromise the machine. We're talking millions of installations," Weizman said.

"This extension was able to perform a classic privilege escalation. Because Claude now has access to files in the operating system, it can execute code in the operating system and completely compromise the machine. We're talking millions of installations," Weizman said.

Weizman discovered and disclosed the Claude Dispatch flaw, which he named ThisBash, to Anthropic. The company acknowledged his report as a valid vulnerability in May but classified the security issue as a duplicate of a known flaw it was already tracking. Anthropic did not pay Weizman a bug bounty or assign a CVE identifier, but said it planned to discontinue Dispatch at the end of October. That did not happen.

Even if Anthropic does eventually shut down Dispatch, Weizman says the fundamental design flaw in Claude will remain. The security gap will persist in other features, including Claude Code's remote control functionality and Claude Cowork sessions.

"Claude Cowork is now available through the web version, and it uses the same sessions as the desktop version. Again, using an extension, you can access Cowork sessions and say, 'Please access this file and retrieve it. Please install this malicious npm package. Please execute code in the operating system,' and it will do so," Weizman says.

"Claude Cowork is now available through the web version, and it uses the same sessions as the desktop version. Again, using an extension, you can access Cowork sessions and say, 'Please access this file and retrieve it. Please install this malicious npm package. Please execute code in the operating system,' and it will do so," Weizman says.

He reported the situation to Anthropic, but "they still decided to do nothing it." Details how the vulnerability works and how it was disclosed can be found in the researcher's publication on the Forever Security website and in The Register's report.

Claude received Personal Finance to analyze bank accounts and expenses