Researchers show how Claude Dispatch can let browser extensions run code

Forever Security demonstrated that an extension able to run scripts on claude.ai could use Dispatch to execute code through Claude Desktop. Dispatch lets users send tasks from their phones to the desktop app. According to Cyber Security News, the targeted computer could be another machine signed into the same Claude account.

• Researcher Gal Weizman named the technique ThisBash, according to Cyber Security News.

Covered by 2 publishers within 3 hours of the first report.

• The Hacker News: Malicious Browser Extensions Could Use Claude Dispatch to Run Code on Users' Computers

Reporting2

CSN Cyber Security News Claude Dispatch Flaw Lets Malicious Browser Extensions Run Code on Connected Computers · Guru Baran 3:40 AM

THN The Hacker News Malicious Browser Extensions Could Use Claude Dispatch to Run Code on Users' Computers · info@thehackernews.com (The Hacker News) 7:06 AM

Related

CSN Researchers Hacked Cursor, GitHub Copilot, Codex, VS Code, and Claude Desktop Embedded Browsers October 29

THN Yoba attackers use fake ChatGPT and Claude apps to install crypto miners October 29

IMP Cursor's Marketplace Hands Developers a Backdoored Claude Code October 31

TS Anthropic updates Claude Code to reject requests to copy existing games November 1

Topics Anthropic