Two unpatched vulnerabilities in Anthropic’s Claude for Chrome browser extension allow any malicious browser extension to hijack Claude’s agentic capabilities, silently reading a victim’s Gmail, Google Docs, and Calendar data.
Ax Sharma at Manifold disclosed the flaws, which remain reproducible in v1.0.80, released July 7, 2026, eight releases after they were first reported in May. The first flaw stems from a missing event.isTrusted check in Claude’s content script.
After Anthropic restricted external prompt injection following the earlier ClaudeBleed disclosure, the extension now only accepts nine hardcoded task IDs, including usecase-gmail, usecase-gdocs, and usecase-calendar, triggered via clicks on a specific DOM element.
Claude for Chrome Flaw
The problem: the click handler never verifies whether the click was genuinely user-initiated.
Any extension with a content script on claude.ai can inject the trigger element and dispatch a synthetic click, causing Claude to execute privileged data-reading tasks without real user consent.
- CVSS 7.7 (High) in default “Ask before acting” mode, since an approval modal still appears
- CVSS 9.6 (Critical) when “Act without asking” is enabled, since Claude executes silently
The second issue involves how Claude’s side panel enters privileged mode. Loading the panel with a “skipPermissions=true” parameter in its URL sets the permission state to skip all checks, with no user gesture or consent gate required.
A warning banner appears, but only after privileged mode is already active. Anthropic argues this parameter is only set internally, so it isn’t directly remotely exploitable today.
Manifold counters that it creates a latent escalation path, since any future bug exposing side-panel URL construction would instantly grant silent, Critical-severity access to a user’s connected accounts.
Manifold reported both issues to Anthropic on May 21, 2026, against v1.0.72. Anthropic acknowledged the reports the next day but subsequently closed both, one folded into an existing tracking report on the trust-boundary issue, the other closed as informative.
Anthropic’s internal tracking issue was marked “Resolved” before June 9. Yet Manifold’s July 7 verification found the cited content-script and side-panel code byte-identical to the original vulnerable version.
Ax Sharma draw a direct parallel to the earlier ClaudeBleed disclosure from LayerX, where an announced fix later proved incomplete.
Both findings map to OWASP’s LLM Top 10, specifically indirect prompt injection and excessive agency, and illustrate a growing blind spot in agentic AI security: traditional monitoring tools see only authenticated HTTPS traffic and a running extension, with nothing appearing unusual in the logs.
The compromise happens entirely within the trust boundary between “what messages can be sent” and “what counts as genuine user intent.” The suggested fix is trivial, a single isTrusted check, but remains unimplemented across eight release cycles.
For organizations deploying agentic browser extensions like Claude for Chrome, this underscores the need for runtime behavioral monitoring rather than reliance on static access-control assumptions.
Give your SOC the intelligence it needs to act with confidence.
Explore ANY.RUN Threat Intelligence Feeds to reduce noise and improve operational efficiency.
