Claude Chrome extension flaw lets malicious extensions trigger AI actions

Malicious Chromium extension spoofs Perplexity AI to hijack browser searches

Supply chain analysis: Kickbacks.ai VS Code extension. Empty pubkey, CSP relaxation, 90-second unsigned self-update, 60-second reassertion loop

From Chrome Extension Supply-Chain Compromise to Host Malware: Technical Breakdown of the ShotBird Campaign