Claude Dispatch flaw lets malicious browser extensions run code
Browser extensions can force Claude agents to run commands on connected devices via prompt injection.
1
Stories per day · 30 days
2 RSS
Relatedcrypto-wallets3firefox3ai-security2bonto2claude2credential-theft2dispatch2adware1chrome1confused-deputy1cross-boundary1google-ads1infostealer1native-messaging1phantom1prompt-injection1remote-code-execution1search-hijacking1
20 stories, newest first · one card per story
Stories tagged #browser-extensions
NativeMessaging enables host-to-browser cross-boundary attacks
Non-privileged malicious native apps misuse the NativeMessaging API to intercept sensitive data or launch confused deputy attacks against browser extensions with over 532 million cumulative downloads.
Fake PDF and search tools hijacked searches for 13.4 million Chrome users
Socket tied 319 mostly unlisted Chrome Web Store extensions, promoted by ads, to query proxying toward Yahoo or Bing.
1
Malicious Firefox extensions impersonate Phantom, Jupiter, and Bitget
Socket says the add-ons stole recovery phrases and private keys; the Phantom copy sent secrets to Telegram and moved funds.
1
Malicious Firefox extensions impersonated Phantom, Jupiter, and Bitget
Socket says the removed listings sent recovery phrases to bonto.io, and Phantom’s package included a multi-chain drainer.
1
16 Malicious Firefox Extensions Pose as Rabby and OKX Wallets to Steal Recovery Phrases
Sixteen malicious Firefox extensions impersonating Rabby and OKX wallets stole recovery phrases via Cloudflare Workers.
7
When Productivity Extensions Become Attack Platforms
Akamai found 32 malicious browser extensions using remote configs to spy on more than 9,800 users.
2
Know Your Enemy: Browser-Based Attack Techniques in 2026
Push Security survey details six dominant browser attack techniques for 2026, including AiTM phishing, ClickFix, OAuth abuse, and session hijacking.
10
Crypto Scam Extensions Masquerade as High-Profile Investors
Akamai research documents crypto scam browser extensions that impersonate high-profile investors to defraud victims.
Malicious VPN Extensions Turn Browser Users Into Residential Proxy Servers
Thirty-one malicious Chrome VPN extensions enrolled about 356,000 browsers into a remotely controlled residential proxy network.
2
Weekly Update 522: Live From Oslo with Scott Helme
Troy Hunt and Scott Helme discuss detecting malware-infected machines via CSP reporting and a surge of malicious browser extensions found with a local LLM.
AI Drives Surge in Bot and API Threats
Akamai says AI drove a 300% rise in bot traffic and a 113% increase in daily API attacks.
2
BragJack attacks hijack AI browser agents through malicious extensions
Forever Security's Gal Weizman disclosed BragJack, a malicious-extension technique hijacking AI browser agents from Chrome Gemini to Claude, earning $20,000 in bounties.
BragJack Attack Lets Malicious Extensions Hijack AI Agents Across 5 Major Browsers
Researchers demonstrated 'BragJack' browser-extension attacks that hijack AI agents in Chrome, Edge, Comet, Opera Neon, and Claude, leading to two CVEs and vendor patches.
8
One Extension Could Hijack AI Assistants Across Chrome, Comet, Edge, Opera Neon and Claude
Researchers showed a single browser extension could hijack AI agents in Chrome, Edge, Comet, Opera Neon and Claude in Chrome, earning $20,000 in bounties.
3
ThreatsDay: 200 Android Flaws, Browser-Built Phishing, 119K Scam Shops + 23 More Stories
Hacker News ThreatsDay digest: malicious browser extensions, AI-agent intrusions, NCSC shadow AI warning, M&A wire fraud, and 119,000-domain fake shops.
3
Attackers impersonate popular AI brands to spread malware
Sophos documented 38 MDR cases where attackers impersonated AI brands like Claude and Perplexity to deliver infostealers and backdoors.
2
40 Malicious Firefox Extensions Pose as Web3 Products to Steal Wallet Secrets
Socket found 40 malicious Firefox extensions impersonating OKX, Rabby Wallet, and TronLink to steal cryptocurrency wallet recovery phrases and private keys.
1
ApateWeb: An Evasive Large-Scale Scareware and PUP Delivery Campaign
Unit 42 uncovers ApateWeb, a campaign using over 130,000 domains and multilayered redirects to deliver scareware, adware and PUPs to millions of users.
737 Chrome VPN Extensions Caught Routing Traffic Through Proxies. Check If You Have One
Researchers found 737 Chrome VPN extensions, many impersonating brands like NordVPN, routing roughly 75,000 users' browser traffic through attacker-controlled SOCKS5 proxies.
2