{
  "entry": {
    "kind": "vuln",
    "slug": "claude-desktop-silently-installs-browser-extension-bridges-privacy",
    "name": "claude-desktop-silently-installs-browser-extension-bridges-privacy",
    "vendor": "Claude Desktop",
    "description": "Security researcher Alexander Hanff discovered that Claude Desktop silently installs Native Messaging host manifests into seven Chromium browsers (Chrome, Brave, Edge, Arc, Vivaldi, Chromium, Opera) on first launch, including browsers not installed on the machine. The manifests pre-authorize browser extensions to access authenticated sessions and DOM data. Files are rewritten on every app launch, preventing persistent removal. Anthropic's own testing showed the feature is vulnerable to prompt injection roughly 25% of the time.",
    "website": "https://www.thatprivacyguy.com/blog/anthropic-spyware/",
    "repository": null,
    "documentationUrl": null,
    "license": null,
    "version": null,
    "trustLevel": "advisory",
    "capabilities": [],
    "packaging": null,
    "configFiles": null,
    "category": "agent",
    "updatedAt": "2026-04-18",
    "risk": {
      "score": 75,
      "band": "high",
      "signals": [],
      "dangerousCombos": []
    },
    "dangerousCombos": [],
    "vuln": {
      "id": "claude-desktop-silently-installs-browser-extension-bridges-privacy",
      "aliases": [
        "ti-013"
      ],
      "title": "Claude Desktop Silently Installs Browser Extension Bridges: Privacy Violation",
      "summary": "Security researcher Alexander Hanff discovered that Claude Desktop silently installs Native Messaging host manifests into seven Chromium browsers (Chrome, Brave, Edge, Arc, Vivaldi, Chromium, Opera) on first launch, including browsers not installed on the machine. The manifests pre-authorize browser extensions to access authenticated sessions and DOM data. Files are rewritten on every app launch, preventing persistent removal. Anthropic's own testing showed the feature is vulnerable to prompt injection roughly 25% of the time.",
      "severity": "high",
      "cvss": {
        "score": null,
        "vector": null,
        "version": null
      },
      "cwe": [],
      "attackType": [
        "Other"
      ],
      "componentType": "agent",
      "component": {
        "name": "Claude Desktop",
        "vendor": null,
        "package": null,
        "ecosystem": null,
        "catalogSlug": null
      },
      "affected": [
        {
          "range": "Claude Desktop (macOS, all versions with browser automation)",
          "fixed": null
        }
      ],
      "exploited": false,
      "exploitPublic": false,
      "publishedAt": "2026-04-18",
      "modifiedAt": "2026-04-18",
      "lastVerified": "2026-11-01",
      "references": [
        {
          "type": "article",
          "url": "https://www.thatprivacyguy.com/blog/anthropic-spyware/"
        }
      ],
      "mitigation": "Audit for com.anthropic.claude_browser_extension.json in browser NativeMessagingHosts directories. Remove unwanted manifests. Monitor for reinstallation after Claude Desktop launches. Consider blocking Claude Desktop browser automation via MDM policy.",
      "detectedByAnomity": true
    }
  }
}