Two vulnerabilities in Anthropic’s Claude for Chrome extension could allow a malicious browser extension to trigger AI-driven actions affecting a victim’s Gmail, Google Docs, and Google Calendar data.
These issues are still reproducible in Claude for Chrome version 1.0.801.0, released on July 7, 2026, even after being reported to Anthropic in May.
The primary issue arises from a content script that listens for clicks on elements using the `#claude-onboarding-button` selector. The event handler reads a `data-task-id` attribute and forwards one of nine hard-coded prompts to the Claude side panel.
Although Anthropic restricted external prompt submissions to this allowlisted set due to previous security concerns, the click handler reportedly fails to verify whether the event originated from genuine user interaction.
Critical Claude for Chrome Flaw
According to Manifold Security researcher Ax Sharma, any extension with script access to claude.ai could inject a matching DOM element, assign a permitted task ID, and dispatch a synthetic click event.
Because the handler does not check the browser event’s `isTrusted` property, Claude mistakenly treats a programmatically generated event as legitimate user intent.
#BF8534) at bottom. (Source: Manifold)The permitted prompts are not limited to harmless onboarding tasks; they include actions that can instruct Claude to read recent Gmail messages, identify promotional emails, open and review comments in a user’s most recent Google Doc, check calendar availability, and create meetings. Other supported tasks can interact with services such as Salesforce, DoorDash, and Zillow.
In Claude’s default “Ask before acting” configuration, any attack would populate the side panel with the selected task and require the victim to approve the action.
However, the impact becomes much more serious when a user has enabled “Act without asking.” In that mode, Claude can execute the invoked task without displaying an approval dialog, creating a silent pathway for data access and action execution.
Manifold assigned the synthetic event issue a CVSS score of 7.7 in the default configuration and 9.6 when unattended execution is enabled.
The firm noted that the flaw affects the browser extension’s trust boundary rather than the underlying Claude model. It confirmed that the issues can be reproduced across Opus, Sonnet, and Fable side-panel model selections.
A second issue concerns the extension’s privileged-mode initialization. The Claude side panel is reportedly enabled with `skip_all_permission_checks` whenever it is loaded with the `?skipPermissions=true` URL parameter. This parameter can place the panel in “Act without asking” mode without requiring an explicit user gesture or consent.
Manifold pointed out that this second flaw is not directly exploitable remotely in version 1.0.801.0, as constructing the required side-panel URL currently necessitates extension-level privileges.
Nevertheless, it poses a high-risk architectural condition; any future URL construction flaw, a same-extension XSS, or an improperly exposed message handler could turn it into a vector for silent execution.
The researchers recommend rejecting synthetic events by checking `event.isTrusted` in the click handler. They also advise Anthropic to eliminate URL-parameter-based permission initialization, start panels in approval mode by default, and require user-driven permission transitions.
Both issues fall under OWASP’s LLM security categories: indirect prompt injection and excessive agency. Although Anthropic reportedly closed the reports, Manifold maintains that the cited code paths have remained unchanged across eight extension updates.
Gain browser-level visibility to expose decrypted phishing pages, speed investigations, and cut credential theft costs -> Power your SOC with ANY.RUN
