Unverified50% confidenceConceptExact time
Rendering-based data exfiltration refers to an attacker inducing the victim's client-side rendering engine to actively initiate network requests carrying sensitive information when parsing malicious content, with common vectors including <img src>, CSS url(), <link> preloading, and Markdown image syntax, and the core of defense being Content Security Policy (CSP).
1
Sources
50%
Confidence
Long-term
Relevance
10/15/2026
First Seen
Sources
Claude Code Desktop Vulnerability Exposed: Preview Pane Becomes a Data Exfiltration Channel
hackernewshackernews10/15/2026
Related Entities
Related Claims
UnverifiedCSP (Content Security Policy) is a set of browser security rules delivered by the server via HTTP response headers (such as Content-Security-Policy), used to declare which sources of resources a page is allowed to load, with typical directives including script-src, img-src, connect-src, and frame-ancestors.68% similarUnverifiedAn attacker can embed maliciously crafted content such as image tags or links with dynamic URLs in project files, and when a developer uses the preview function in Claude Code Desktop to view the file, an external request is triggered, and the URL parameters carried in the request may contain local environment information, file paths, or other sensitive data.67% similarUnverifiedIn rendering scenarios embedded in desktop applications, even without HTTP response headers, a CSP-like effect can be achieved through <meta http-equiv="Content-Security-Policy"> or configuration items of the rendering engine.67% similarUnverified间接注入攻击手法包括在网页嵌入与背景色相同的隐藏文字、在PDF元数据或注释字段植入越狱指令、利用Markdown语法伪装恶意提示66% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1033934API
curl https://kongchang.com/api/v1/knowledge/claims/1033934MCP
get_claim(id=1033934)