You'll notice
Chrome file-upload path checks now also block NTFS alternate-data-stream syntax and an additional kernel-alias check
What
When Claude Code's Chrome integration handles a file upload, it checks the file path against a list of disallowed patterns meant to catch attempts to reference files through unusual OS-level aliases. That check now also rejects paths using NTFS alternate-data-stream syntax (paths matching :$[a-z_]) and runs an additional new check, on top of the existing checks for dev/proc/namedfork paths and split paths.
Why
This closes another potential way a malicious or malformed path could sneak past file-upload validation by exploiting a filesystem-specific path format, tightening the security around what files Chrome can be told to upload.