No CVE, Anthropic’s patch only partially fixes the issue.
Ok, I am wondering if I am misunderstanding something here - my understanding from the linked post is that the JS injection/execution in claude[.]ai is the prerequisite for the attack, not the result? The result would be being able to trigger the Claude extensions to take malicious actions?
To be honest, as someone who hasn’t looked at Browser Extension permissions in any detail the idea that “executing JS in a page context” isn’t a special permissions sounds more wild than the actual vulnerability 
Not exactly. Basically the permissions gap in the extension means any script injected into Claude.ai will be able to use the Claude extension to send privileged commands to Claude, among other things.
9. Full Attack Chain
- Inject script into claude.ai (via zero-permission extension)
- Send messages to Claude extension
- Trigger arbitrary prompt execution
- Bypass confirmation via approval looping
- Manipulate DOM to alter Claude’s perception
- Execute sensitive cross-site actions