Claude Chrome Extension Flaw Lets Malicious Add-Ons Steal Gmail and Drive Data

A critical vulnerability dubbed “ClaudeBleed” has compromised Anthropic’s trusted AI assistant, potentially turning it into a backdoor.

This severe design flaw in the Claude Chrome extension allows malicious add-ons to hijack the AI secretly.

Even extensions with zero declared permissions can exploit this vulnerability to steal sensitive data from Gmail, Google Drive, and GitHub. In the race to deploy automated AI productivity tools, fundamental security boundaries are being bypassed, leaving millions of users exposed to silent data exfiltration.

The root of the issue is a systemic trust boundary violation within the extension’s architecture.

According to the LayerX disclosure, the Claude extension relies on the externally_connectable manifest setting to communicate with the main Claude website.

While the application effectively verifies the origin domain, it completely fails to authenticate the specific script executing the commands.

Consequently, an attacker can deploy a bare-bones Chrome extension that injects a content script directly into the main world of the Claude environment. Because the system assumes any script running on the official domain is legitimate, the malicious extension seamlessly inherits the AI’s high-level privileges.

Researchers demonstrated that attackers can then issue hidden prompts, effectively forcing the AI to act as a confused deputy to carry out unauthorized, highly sensitive tasks.

Exploitation and Attack Chain

Once initial execution is achieved, attackers must navigate Claude’s built-in guardrails to perform actions. They accomplish this using two primary bypass techniques: approval looping and perception manipulation.

LayerX analysts observed that by repeatedly sending confirmation commands, attackers can automatically forge user consent.

Furthermore, bad actors can dynamically alter the page’s Document Object Model (DOM). By renaming a sensitive “Share” button to something benign, such as “Request feedback,” attackers can easily trick the AI into authorizing restricted actions.

These techniques enable alarming real-world exploitation scenarios that require absolutely zero user interaction. During testing, researchers successfully weaponized the flaw to exfiltrate classified files from Google Drive and share them with outside users.

LayerX reports that the exploit can also be used to steal proprietary source code directly from private GitHub repositories. Additionally, an attacker could instruct Claude to summarize a victim’s last five emails, forward that summary to an external address, and immediately delete the sent message to cover their tracks.

LayerX responsibly disclosed the vulnerability to Anthropic on April 27, 2026. In response, Anthropic released version 1.0.70 on May 6, 2026. This update introduced new explicit approval flows in the extension’s isolated side panel for actions that require elevated browser privileges.

Unfortunately, security experts emphasize that this fix is incomplete and only addresses the symptoms rather than the underlying origin-based trust flaw.

Claude currently operates with two distinct modes: a standard “Ask before acting” setting and a privileged “Act without asking” mode designed for uninterrupted automation. When a user enables the privileged mode, the newly implemented security checks become completely ineffective.

Attackers can programmatically detect when this autonomous mode is active and resume injecting malicious prompts without triggering any user notifications. The core vulnerability remains actively exploitable, highlighting how AI vendors continue to prioritize usability over rigorous security validation.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.