Malicious Browser Extensions Could Use Claude Dispatch to Run Code on Users' Computers

Researchers at Forever Security, an endpoint security company, have demonstrated that a malicious browser extension can exploit a feature called Dispatch in Claude to run code on a user's computer. This is made possible by a browser extension that can run scripts on claude.ai, in conjunction with the Dispatch feature that allows tasks to be sent from a phone to Claude Desktop. The flaw that enables this attack is still exploitable, according to the researchers. The vulnerability relies on the interaction between the browser extension and the Claude Desktop application. The researchers' test showed that this combination can be used to run code on a person's computer. The exploit takes advantage of the Dispatch feature to execute the code.