Browser extensions could use Claude Dispatch to run code on a desktop, researchers say
Forever Security showed that an extension able to run scripts on claude.ai could get Claude Desktop to execute code. The researchers say the flaw can still be exploited.
Researchers at Forever Security, an endpoint security company, showed in a test that a browser extension able to run scripts on claude.ai could make Claude Desktop run code on a person's computer. The Hacker News reported the finding on Nov 06, 2026.
The route runs through Dispatch, a Claude feature that lets people send tasks from their phone to Claude Desktop. The extension doesn't need to be malicious in itself; what matters is that it can execute scripts on the claude.ai page, which the researchers used to reach the desktop app.
The researchers said the flaw that makes this possible can still be exploited. That's the part worth noting: this isn't a fixed-and-closed case as far as the source goes. The report doesn't say whether Anthropic has responded, whether a patch is out, or how many people or installs are affected. Nobody has published a fuller technical write-up that we've seen.
For defenders, the practical question is which extensions can run scripts on claude.ai, and whether Dispatch is turned on for people who don't need it. Extension permissions are the thing to look at first, not the AI feature itself.
We'd treat the silence on a fix as the open item here rather than the demo.
Sources
- Malicious Browser Extensions Could Use Claude Dispatch to Run Code on Users' ComputersPrimarythehackernews.com
If something here is wrong, tell us. Every correction is listed on the corrections page.
Don’t Just Read About Cyberattacks. Learn How They Work.
Go beyond the headlines. Explore hands-on cybersecurity labs, understand real-world vulnerabilities, and build practical security skills with HackZoneLabs.
Start Learning
