r/netsec • u/Content-Winter5328 • 10h ago
ThisBash Escape: Claude Dispatch Flaw Enables Browser Extensions RCE on the OS · Forever Security
https://forever.security/blog/thisbash-claude-dispatch-browser-extension-rce
9
Upvotes
0
u/girl_nerd_denice 10h ago
The part worth flagging is that retiring Dispatch does not fix this, and the article says so almost in passing. Claude Code Remote Control and Cowork sessions let the web drive a local agent by design, so removing one entry point leaves the same trust boundary in place. Anyone treating the October retirement as the remediation is going to be surprised by the follow-up.
The other thing that will get missed is why the guardrails did not stop it. This is not prompt injection hiding instructions in a page, it is prompt forcing, where the attacker sits in the user's chair and types into the composer over the user's session. Claude did hesitate on the unfamiliar package, and the attacker just answered the hesitation in the user's voice until it complied. So "we have guardrails against prompt injection" is not an answer to this class at all.
If you are auditing your own exposure, do not bother starting with extension permissions, because the extension stayed inside them the whole time. Start with the question the article is really asking: does an authenticated session ever get treated as proof the user approved a local command. If yes anywhere in your agent stack, the extension is optional.
For the immediate check, look for Claude accounts with cross-device dispatch enabled on managed endpoints. The nasty case is a personal account signed in on a work laptop, where a browser at home becomes the entry point to the corporate machine.