An indirect prompt injection vulnerability in Claude on Chrome can be exploited to steal email verification codes and hijack accounts on platforms like Slack, X, and Claude.ai.
The attack begins with a malicious email that lands in the victim’s Gmail inbox. When the user requests Claude in Chrome to summarize recent emails, the assistant may inadvertently read the attacker-controlled message.
Hidden instructions within the email can manipulate Claude into running JavaScript using its javascript_tool, all without the victim’s awareness.
Previous research documented the complete path from a simple browser alert to arbitrary code execution. This latest analysis focuses on the more severe consequence: account takeover via email-based authentication.
The crucial issue is that the JavaScript tool operates within the victim’s authenticated browser session. This means that malicious code can access services already logged in, including Gmail.
An attacker can trigger a password reset, magic-link login, or verification-code request for another service and then monitor the victim’s inbox for the resulting messages.
Claude in Chrome Prompt Injection
Gmail’s Atom feed endpoint plays a central role in this research. Since the browser session is already authenticated, attacker-controlled JavaScript can request recent unread email metadata from Gmail. It can then search for messages containing confirmation codes for Slack, password-reset codes for X, or magic links for Claude.ai.
Zenity Labs researchers found that attackers used malicious JavaScript packages hosted on a custom package registry designed to imitate a legitimate content delivery network (CDN).
A package could appear to conduct a harmless action, such as generating a UUID, while secretly initiating the account takeover process before returning a seemingly harmless result.
In the Slack scenario, the attack begins by requesting a Slack sign-in code for the victim’s email address. A separate automated browser process navigates Slack’s login flow and submits the email address.
Once Slack sends its confirmation code, code running in the victim’s browser reads the Gmail Atom feed, extracts the code, and sends it to the attacker. The attacker can then complete the login as the victim.
The attack on X required more reverse engineering because its password-reset process involves several stateful API steps and checks for browser instrumentation.
Researchers mapped X’s onboarding endpoint, guest-token process, flow tokens, and JavaScript-based telemetry challenge.
After initiating a password reset and retrieving the verification code from Gmail, the attack could set a new password and obtain an authenticated session cookie.
Claude.ai was also vulnerable through its passwordless magic-link process. Researchers found that an emailed magic link includes a nonce in its URL fragment.
By reading the message from Gmail, an attacker could extract that nonce and submit it to Claude.ai’s authentication endpoints. Successful verification would then set a session cookie, granting access to the victim’s account.
A compromise of a Claude.ai account could have especially wide-ranging consequences. An attacker might gain access not only to chat history and uploaded files but also to authorized connectors such as Gmail, Google Drive, Calendar, Slack, and GitHub.
This research highlights a dangerous combination: indirect prompt injection, browser-based code execution, and email as an authentication medium.
Any AI browser agent capable of reading untrusted content and executing code in a logged-in session can turn access to an inbox into an account takeover vulnerability.
Strengthen Your SOC by Accelerating Threat Detection & Rapid Investigations. -> Integrate ANY.RUN With Your SOC Now.
