A combined vulnerability in the Anthropic Claude Chrome Extension allowed any malicious website to silently inject instructions into a user’s Claude AI assistant without any click or interaction. The flaw combined an overly permissive trust boundary in the extension with a cross-site scripting weakness in a third-party CAPTCHA component embedded on the claude.ai subdomain. If exploited before patching, an attacker could have stolen credentials, accessed conversation history, or triggered autonomous actions such as sending emails on behalf of the victim, with no visible indication to the user.