An indirect prompt injection vulnerability in Claude on Chrome allows attackers to steal email verification codes and hijack accounts on platforms like Slack, X, and Claude.ai This article explores zenity labs attack. . If the user clicks on the link provided by Claude, it may inadvertently trigger JavaScript execution based on hidden instructions within the email.
The key concern is that the JavaScript tool exploits vulnerabilities within the victim's authenticated browser session, allowing it to access services already logged into Gmail. An attacker can trigger password resets, magic-link logins, or verification-code requests for other accounts and then monitor the recipient's inbox for the resulting messages. Zenity Labs researchers discovered that attackers used malicious packages on a custom package registry designed to mimic legitimate CDNs.
Researchers found that the attack begins by requesting a sign-in code for the victim’s email address through Slack's email-based authentication flow (source: Zenity Labs). The attack starts with a seemingly harmless request, such as generating a UUID, while secretly initiating the account takeover process before returning a benign result. This attack on X required more reverse engineering due to its complex password-reset process involving multiple stateful API steps and checks for browser instrumentation.
A compromised Claude.ai account could lead to significant exposure, including chat history, uploaded files, and even authorized connectors like Gmail, Google Drive, Calendar, Slack, and GitHub.
