{"version":"2.1.269","anchor":"chrome-file-upload-path-checks-gain-ntfs-alternate-data-stre","canonical_anchor":"chrome-file-upload-path-checks-gain-ntfs-alternate-data-stre","heading":"Chrome file-upload path checks gain NTFS alternate-data-stream and kernel-alias guards","tier":"notice","area":"Elsewhere","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.269\/e\/chrome-file-upload-path-checks-gain-ntfs-alternate-data-stre","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.269","markdown":"### Chrome file-upload path checks gain NTFS alternate-data-stream and kernel-alias guards\n\nChrome file-upload path checks now also block NTFS alternate-data-stream syntax and an additional kernel-alias check\n\n**What**\n\nWhen Claude Code's Chrome integration handles a file upload, it checks the file path against a list of disallowed patterns meant to catch attempts to reference files through unusual OS-level aliases. That check now also rejects paths using NTFS alternate-data-stream syntax (paths matching `:$[a-z_]`) and runs an additional new check, on top of the existing checks for dev\/proc\/namedfork paths and split paths.\n\n**Why**\n\nThis closes another potential way a malicious or malformed path could sneak past file-upload validation by exploiting a filesystem-specific path format, tightening the security around what files Chrome can be told to upload.\n\n- Area: Elsewhere\n- Tier: You'll notice\n- Useful: 2\/5\n- Signal: 1\/5"}