Researchers Say Claude for Chrome Flaw Lets Rogue Extensions Trigger Gmail Reads
A security vulnerability exists in the Claude for Chrome extension, allowing malicious extensions to trigger unauthorized actions within the user's Gmail, Google Docs, and Calendar accounts. The vulnerability stems from a flaw in how the extension handles synthetic clicks, bypassing permission checks and enabling silent account access. While Anthropic initially addressed the forged-click issue, deeming it covered by a previous report, the underlying trust boundary remains open, allowing a future exploit to bypass the approval process entirely. The vulnerability has persisted for eight releases and is considered a high-risk issue.
A security vulnerability exists in the Claude for Chrome extension, allowing malicious extensions to trigger unauthorized actions within the user's Gmail, Google Docs, and Calendar accounts. The vulnerability stems from a flaw in how the extension handles synthetic clicks, bypassing permission checks and enabling silent account access. While Anthropic initially addressed the forged-click issue, deeming it covered by a previous report, the underlying trust boundary remains open, allowing a future exploit to bypass the approval process entirely. The vulnerability has persisted for eight releases and is considered a high-risk issue.
Any rogue extension that can reach the claude.ai domain can trigger Claude for Chrome tasks aimed at your Gmail, your latest Google Doc and its comments, and your Calendar. The issue is rooted in a content script within the extension that listens for a specific element (#claude-onboarding-button) and, if the element's task ID is one of nine allowlisted prompts, sends an open_side_panel message carrying the matching prompt. The handler never checks `event.isTrusted`, a browser flag that would indicate a genuine user click.
This means any extension can build the element, set the task ID, and dispatch a synthetic click, treating it as a genuine tap. Manifold Security demonstrated this with six lines pasted into the claude.ai console, confirming the fake click was honored. The vulnerability is not new; a separate flaw patched earlier this year allowed any website to silently inject prompts into the extension, and ClaudeBleed began in late April when LayerX found that Claude for Chrome trusted the claude.ai origin instead of checking which script was actually talking to it, driving the assistant from a zero-permission extension and finding Anthropic's first mitigation incomplete.
Anthropic initially addressed the forged-click issue, deeming it covered by a previous report, but the underlying trust boundary remains open. The vulnerability has persisted for eight releases and is considered a high-risk issue. The vulnerability is classified as indirect prompt injection, where an attacker triggers one of the extension’s nine allowlisted prompts with a forged click, and the silent-execution risk to excessive agency. Both findings weaken the same boundary: Claude accepts a script-generated click as your intent, and its permission state can be set from a URL. Eight releases on, that boundary is still where Manifold left it in May. The vulnerability is classified as a high-risk issue and is being actively monitored by security researchers. The Hacker News pulled version 1.0.80 from the Chrome Web Store, unpacked it, and went through all 90 of its JavaScript bundles: the onboarding click handler fires on any matching click with no event.isTrusted guard, and the side panel reads skipPermissions from its own URL and switches into skip_all_permission_checks when it is set.