SneakPeek: Claude Code Desktop preview pane could leak local secrets from large HTML files

Vulnerability · Claude Code Desktop · HIGH

Incident dateNot stated

DisclosedOct 14, 2026 (PR Newswire and CSO Online). Reported privately Jul 4, 2026. Final patch verified Aug 17, 2026. GHSA/CVE not public yet.

Added hereOct 14, 10:32 AM ET

Last verifiedOct 14, 2026

Summary

Noma Labs disclosed SneakPeek, a flaw in Anthropic's Claude Code Desktop preview pane. HTML files over 256KB were written to disk and loaded as file:// URLs, which skipped the Content Security Policy applied to smaller files. Embedded JavaScript could then read local files such as AWS credentials, SSH keys and OAuth tokens and send them out. Anthropic assigned CVSS 8.7 (High) and, after an initial patch that Noma Labs bypassed with a Web Worker, shipped a full fix. A GitHub Security Advisory and CVE are not public yet; Noma says Anthropic is preparing them.

Severity

HIGH Silent reads of developer secrets from opening or editing a poisoned HTML file in the preview pane, with no further confirmation. Anthropic scored it CVSS 8.7 High. Fully fixed after coordinated disclosure.

Timeline

Jul 4, 2026
Noma Labs submits the initial report and a proof of concept to Anthropic.
Jul 9, 2026
Anthropic triages the report, assigns CVSS 8.7 (High), and deploys an initial renderer mitigation.
Jul 24, 2026
Anthropic asks for a retest. Noma Labs shows a bypass: file reads from a Web Worker started via a blob: URL.
Aug 5, 2026
Anthropic confirms the worker bypass and starts a full architectural fix.
Aug 17, 2026
Final security patch verified and deployed. Noma Labs marks the issue resolved.
Oct 14, 2026
Noma Labs and CSO Online publish the disclosure. A GHSA and CVE are not public yet.

How it happened

Claude Code Desktop's Electron preview pane rendered HTML that Claude generated or edited. Files under 256KB became base64 data: URLs with a strict CSP that blocked scripts. Files over 256KB were written to disk and opened as file:// URLs, which dropped that CSP, gave the renderer local filesystem access in Chromium, and ran while a request filter meant to block file:// access was inactive for static rendering. An attacker could put a padded HTML file with a malicious script in a public repository; asking Claude Code to review or edit it auto-rendered the preview and could exfiltrate host files. Anthropic's first patch blocked fetch() and XMLHttpRequest to file:// origins from the main page, but Noma Labs moved the reads into a Web Worker from a blob: URL and bypassed it. Anthropic then fixed every execution context. To be fair to Anthropic: it collaborated through disclosure, iterated on the bypass, and Noma Labs says the issue is fully resolved.

How to check your app

Update Claude Code Desktop to the latest version. Noma Labs and Anthropic say the vulnerability is fully fixed; a public advisory with a version number is not out yet.
Do not ask Claude Code Desktop to preview or edit HTML from repositories or files you did not write until you have inspected them.
Keep long-lived cloud credentials and SSH private keys off developer machines where you can; prefer short-lived, scoped tokens.
If you used an older Desktop build against untrusted HTML, rotate any local secrets that were on that machine (AWS credentials, SSH keys, OAuth tokens).

Sources

Corrections and updates

None. Re-checked against every source on Oct 14, 2026.

If you want someone to check your own app for problems like this, LockedVibe, which has the same owner as this site, lists its security scans on its pricing page. Disclosure.