Noma Labs discloses SneakPeek, a chain of vulnerabilities in Claude Code Desktop preview window that can silently steal local keys

Noma Labs has disclosed a chain of vulnerabilities called SneakPeek in Anthropic's Claude Code Desktop, with a CVSS score of 8.7, allowing attackers to silently execute arbitrary JavaScript and exfiltrate local credentials; Anthropic has released multi-layered security updates to fix it. The vulnerability lies in the Electron-based preview window: HTML files smaller than 256KB are converted to base64 data: URLs with strict CSP, while files larger than 256KB are written to disk and loaded directly via file:// URLs, bypassing CSP script blocking and gaining local file system access, and the filter used to block file:// requests was not effective during static file rendering. Anthropic's initial patch blocking fetch() and XMLHttpRequest was bypassed by Web Workers launched from blob: URLs, after which a complete fix covering all execution contexts was deployed.