ShadowPrompt: Zero-Click Prompt Injection Chain in Anthropic’s Claude Chrome Extension

ShadowPrompt is a chained zero-click prompt-injection vulnerability in Anthropic's Claude Chrome extension where a DOM-based XSS in a third-party Arkose Labs component served from a trusted subdomain allowed attacker-supplied prompts to be delivered to Claude as if authored by the user. The report explains the attack flow, potential impacts (sensitive data exposure, token theft, unauthorized actions), confirms no public evidence of in-the-wild exploitation, and recommends updating to extension v1.0.41, verifying Arkose Labs fixes, inventorying high-risk AI extensions, and applying enterprise governance.