Vulnerability in Claude Dispatch Allows Code Execution via Browser Extensions

• •A flaw in Claude Dispatch allows browser extensions to execute code on PCs.
• •The vulnerability affects millions of installations and enables privilege escalation.
• •Anthropic has acknowledged the issue but has not prioritized a fix.

A flaw in Anthropic's Claude Dispatch feature enables any browser extension that can control it to execute code on users' PCs, including those signed into the same Claude account. Researchers from Forever Security demonstrated that a malicious extension could send commands to Claude Desktop, allowing it to run arbitrary code without requiring a browser exploit. The vulnerability, named ThisBash, was reported to Anthropic in May 2026, but the company has not prioritized a fix. Although Anthropic announced plans to retire Dispatch by the end of October 2026, the feature remains operational, and the underlying design flaw persists in other Claude functionalities. This vulnerability potentially affects millions of installations, as it allows for privilege escalation and could compromise sensitive data on connected devices. The researchers emphasize that the security gap remains even if Dispatch is discontinued, as similar risks exist in other Claude features.