Claude Desktop Can Be Hijacked By Browser Extensions

A flaw in Claude's Desktop app lets malicious browser extensions run code on your computer using a feature called Dispatch.

Security researchers have uncovered a critical, unpatched vulnerability in Anthropic's Claude Desktop application that could allow attackers to run malicious code on a user's computer. According to a report from endpoint security firm Forever Security, the flaw can be exploited by a malicious browser extension. The attack vector is a specific feature within the Claude ecosystem called Dispatch, which is designed to sync tasks between devices. This discovery exposes a significant security risk for the many developers and professionals who have integrated the popular AI assistant into their daily workflows, turning a trusted productivity tool into a potential gateway for system compromise.

The attack mechanism hinges on the trust relationship between the Claude web interface and the Claude Desktop application. The Dispatch feature allows users to send tasks from their phone or browser to the desktop client for execution. Researchers demonstrated that a malicious browser extension, once installed and granted permissions to run scripts on the `claude.ai` domain, can abuse this functionality. The extension can inject a malicious script into the web page, which then crafts a harmful command and sends it to the desktop app via the Dispatch channel. Because the desktop application implicitly trusts instructions originating from the official Claude website, it executes the command without proper validation, leading to remote code execution (RCE). This effectively breaks the security boundary, or sandbox, that is supposed to isolate browser activities from the underlying operating system.

This vulnerability is a stark example of a growing threat category targeting modern hybrid applications. Many popular tools, from communication platforms like Slack to AI assistants like Claude, use a model where a desktop application acts as a powerful wrapper for a web-based interface. While this architecture offers a seamless user experience, it also creates a potential bridge for attackers to cross from the restricted environment of the browser to the full-privilege environment of a local machine. The incident underscores how convenience features, if not architected with a zero-trust security model, can introduce unexpected attack surfaces. As more AI tools roll out companion desktop apps to offer deeper system integration, securing the communication channels between the web and the desktop will become an increasingly critical challenge for developers and a focal point for attackers.

The immediate takeaway for anyone using the Claude Desktop app is to practice extreme vigilance with browser extensions. This vulnerability proves that an extension is not just a simple browser add-on but a potential vector for a full system takeover. IT and security teams should treat browser extensions as part of their organization's software supply chain, implementing strict policies for vetting, approving, and auditing them on all company devices. Users should immediately review their installed extensions and remove any that are non-essential or from an untrusted source. Until Anthropic releases an official patch, the safest approach may be to use the web-only version of Claude. The industry will be watching closely for Anthropic's response, which will likely involve adding robust validation and sanitization to the Dispatch feature to ensure it can no longer be used as a conduit for malicious commands.

This remote code execution (RCE) vulnerability affects any developer or professional using the Claude Desktop app. It demonstrates how a seemingly isolated browser extension can compromise a local desktop application, bypassing typical sandboxing and creating a significant, unpatched security risk.

The vulnerability exposes companies whose employees use Claude Desktop to potential data theft, malware injection, and corporate espionage. It highlights the growing risk of supply chain attacks through popular developer tools, forcing security teams to re-evaluate the threat model of desktop AI assistants.