A security weakness in Anthropic’s Claude for Chrome extension could allow another malicious browser extension to activate predefined AI workflows without a genuine user click, potentially exposing information held in Gmail, Google Docs and Google Calendar or initiating actions in services such as Salesforce.
The issue was discovered by Manifold Security researcher Ax Sharma, who found that Claude for Chrome did not adequately distinguish between a genuine user interaction and a synthetic click generated through JavaScript.
The attack does not allow an ordinary malicious website to take control of Claude, nor does it give an attacker the ability to submit arbitrary prompts. Instead, the attacker would first have to persuade the victim to install a separate browser extension with permission to run code on the claude.ai domain.
Once installed, that extension could manipulate the page’s Document Object Model (DOM), insert an element containing one of Claude’s recognised workflow identifiers and programmatically generate a click. According to Manifold, Claude would then process the event as though the user had selected the workflow themselves.
The potential consequences depend heavily on the user’s Claude configuration, the connected services available to the extension and whether sensitive operations require confirmation. The risk is greater when Claude’s optional “Act without asking” mode is enabled because supported operations may proceed without an additional approval step.
Manifold said the issue remained reproducible in Claude for Chrome version 1.0.80, released on July 7, despite being reported to Anthropic in May. The researchers assigned the issue a CVSS score of 7.7 under the default approval configuration and 9.6 when automatic action is enabled. Those scores are Manifold’s assessment and do not appear to have been issued by Anthropic.
Missing check allows synthetic clicks
The weakness centres on the way Claude for Chrome listens for interactions with page elements used to launch built-in demonstrations and AI workflows.
When a person physically clicks a mouse button or presses a key, the browser creates a trusted event. Web applications can inspect the event’s isTrusted property to determine whether it originated from the browser in response to a real user action.
A JavaScript-generated event, by contrast, is marked as untrusted. This gives applications and extensions a way to reject synthetic interactions where a real user gesture is required.
Manifold found that Claude’s handler accepted the click without checking whether event.isTrusted was true. As a result, JavaScript running on the Claude website could create the expected page element and dispatch an artificial click that the extension treated as valid.
The browser itself was reportedly behaving as intended: it marked the generated event as untrusted. The security boundary failed because Claude’s extension did not use that signal before transferring the request into its more privileged AI workflow.
Manifold said its proof of concept required only a small amount of JavaScript. The code inserted a DOM element containing a recognised task identifier and dispatched the click event needed to activate it.
This reflects a broader browser-extension security concern. Chrome content scripts can read and modify a page’s DOM when the extension has the appropriate host permissions. Google’s documentation also warns developers that hostile pages can manipulate DOM elements on which a content script depends and recommends treating messages originating from content scripts as potentially attacker-controlled. Chrome’s extension security guidance advises developers to validate input before passing it into privileged extension components.
Attack restricted to nine built-in tasks
The reported weakness does not provide unrestricted access to Claude’s prompt interface. Manifold said an attacker could select only from nine prompts hardcoded into the extension.
Three of the identifiers relate to onboarding exercises:
- challenge-form
- challenge-email
- challenge-equipment
The remaining six launch practical workflows involving external websites or connected services:
- usecase-gmail
- usecase-gdocs
- usecase-calendar
- usecase-doordash
- usecase-salesforce
- usecase-zillow
According to the researchers’ analysis, the Gmail workflow reads recent messages, identifies promotional email and attempts to unsubscribe from it. The Google Docs task opens the user’s latest document and reads its comments and feedback, while the Calendar workflow examines the user’s schedule, identifies available time slots and can create meetings.
The Salesforce task is potentially more consequential in a business environment because it can modify leads and convert them into opportunities. The DoorDash and Zillow tasks interact with their respective consumer platforms.
This fixed list significantly constrains what an attacker can request. A malicious extension could not use the flaw by itself to provide Claude with an arbitrary instruction such as stealing passwords, forwarding an entire mailbox or uploading documents to an attacker-controlled server.
Nevertheless, several of the permitted workflows can cross important security boundaries. They can cause an authenticated AI agent to retrieve private information or alter data in services to which the victim is already signed in.
Manifold described the fixed prompt list as a security improvement over an earlier design that allegedly accepted externally supplied text. However, the missing trusted-event validation created another route through which the permitted workflows could be activated.
Why another extension changes the threat model
The attack requires a malicious or compromised browser extension with access to claude.ai. It cannot be launched solely by visiting a hostile website under the conditions described in the report.
Chrome requires extensions to obtain host permission before injecting scripts into matching websites. These permissions can be declared for specific domains, granted temporarily through the activeTab mechanism or requested at runtime. Google’s content-script documentation confirms that extensions with the necessary permission can execute code against a page and modify its contents.
This prerequisite is important because an extension able to execute on a site already possesses meaningful access to that page. It may be able to inspect information displayed there, alter interface elements and monitor some user interactions.
However, the Claude weakness could allow that local page access to be converted into actions performed through Claude’s authenticated browser-control capabilities. In effect, the malicious extension may be able to borrow the authority that the user granted to the AI assistant.
That could extend the impact beyond the claude.ai page itself. Rather than compromising Gmail, Calendar, Docs or Salesforce directly, the hostile extension could ask Claude to interact with those services through workflows that Anthropic had already defined.
This is a form of confused-deputy problem: a component with elevated capabilities performs an operation for a less-trusted caller because it has not adequately verified the origin or intent of the request.
Claude’s browser privileges increase the potential impact
Claude for Chrome is designed to do considerably more than display chatbot responses. Anthropic says the extension can read pages, click interface elements, enter text, navigate between websites, manage tabs and take screenshots.
Its requested Chrome permissions include access to the browser’s side panel, tabs, scripting and debugger capabilities. The debugger permission is particularly significant because Anthropic says it enables Claude to control the browser by clicking, typing and capturing screenshots. The extension can also use the browser’s existing sign-in state when accessing websites. Anthropic’s Claude for Chrome documentation warns that direct website interaction remains risky despite the addition of safety classifiers.
These capabilities are central to the product’s purpose. They allow users to delegate multi-stage browser tasks that would otherwise require numerous manual actions. However, they also mean that a failure to authenticate the source of a command can have consequences beyond an ordinary interface bug.
A conventional webpage might respond to a fake click by opening a menu or submitting a form. An agentic browser extension can interpret the same interaction as authorisation to begin a workflow spanning multiple websites and authenticated accounts.
Anthropic’s documentation for Google Workspace connectors says Claude mirrors the user’s existing permissions and should access data only when the user explicitly requests an operation requiring it. The reported synthetic-click issue is therefore significant because it could cause the extension to mistake an extension-generated event for that explicit request. Anthropic’s Workspace connector guidance says Claude cannot obtain information the user could not already access, but this still leaves data available to the user potentially exposed to an unintended AI task.
Approval settings determine whether execution is visible
Under Claude’s standard configuration, sensitive operations may still generate a confirmation request. This provides an additional barrier, but it does not fully eliminate risk.
A user who unexpectedly sees an approval prompt may reject it. However, the prompt might appear plausible if it involves a service the user regularly accesses, and repeated permission requests can make people less attentive to individual warnings.
Anthropic has itself discussed this problem in the context of AI agents. The company previously reported that users approved approximately 93% of Claude Code permission prompts, leading it to conclude that repeated confirmations are an imperfect security control because of approval fatigue.
The risk becomes more direct if the user has enabled “Act without asking.” Manifold said that configuration could allow one of the recognised tasks to run silently, without requiring the victim to approve the operation after the synthetic click.
This distinction explains the large difference in the researchers’ severity assessments. In the default mode, successful abuse may still require the victim to approve an unexpected request. With automatic execution enabled, the malicious extension may be able to initiate the workflow without a visible confirmation checkpoint.
Second finding involves privileged launch parameter
During the same investigation, Manifold identified a separate internal parameter, skipPermissions=true, used when launching Claude’s side panel.
The researchers said the parameter caused the side panel to initialise in a privileged state without requiring a new user gesture or consent interaction. They characterised this as an architectural weakness that could turn a separate URL-construction vulnerability into a silent-execution route.
However, Manifold acknowledged that the parameter is not directly exploitable on its own. An attacker would need another vulnerability capable of constructing or loading a specially prepared internal extension URL.
That limitation makes the second finding materially different from the synthetic-click issue. The click weakness reportedly has a concrete delivery route through another extension with access to Claude’s website. The launch parameter is instead a potentially dangerous building block that would need to be combined with a separate flaw.
The researchers submitted both findings through Anthropic’s bug-bounty programme. According to Manifold, Anthropic closed the synthetic-click submission because it was already tracking the behaviour as part of a broader issue. The skipPermissions report was classified as informational.
Anthropic’s reported handling of the submissions comes from Manifold’s account. No separate public Anthropic security advisory or CVE identifier was located for either issue at the time of writing.
Researchers say latest release remains affected
Manifold initially examined version 1.0.72 of the extension and later retested its findings against version 1.0.80.
The company said the relevant content-script and side-panel handlers were unchanged between those releases and that both findings remained reproducible as of July 7. The behaviour was also reportedly model-independent, with researchers reproducing it across different Claude models selected in the side panel.
That observation indicates that the weakness resides in the browser extension’s event-handling and permission architecture rather than in the underlying AI model. Switching to a different Claude model would therefore not address the issue.
Manifold has dubbed the research “ClaudeBleed Reopened,” linking it to earlier scrutiny of how Claude for Chrome accepts instructions from browser content. Its full technical report includes the task identifiers, attack conditions, disclosure timeline and the researchers’ severity calculations.
Risk reduction for users and organisations
Until Anthropic releases a confirmed fix, users should review all installed Chrome extensions and remove any that are unnecessary, unfamiliar or no longer maintained. Particular attention should be paid to extensions that request access to all websites or specifically to Claude’s domain.
Chrome users can restrict an extension’s site access through the browser’s extension-management interface. Where possible, access should be limited to specific sites or changed to require a manual click rather than allowing the extension to run automatically on every matching page.
Users of Claude for Chrome should also consider disabling “Act without asking,” especially on browser profiles connected to corporate email, shared documents, calendars, customer-management systems or other sensitive platforms.
Unexpected approval prompts involving Gmail, Google Docs, Calendar, Salesforce, DoorDash or Zillow should be rejected and investigated. Administrators may also want to examine extension inventories for add-ons that can inject content into claude.ai, particularly in managed enterprise browsers.
The report highlights a wider challenge facing agentic browser products. These systems combine webpage access, authenticated sessions and the ability to perform actions across multiple services. That makes reliable verification of user intent a core security requirement rather than a minor interface safeguard.
A synthetic click that might once have changed a setting on a single page can now instruct an AI agent to begin a multi-step operation across connected accounts. As browser-based assistants gain more autonomy, the boundary between page events and privileged agent commands will require stronger controls, including trusted-event validation, strict message authentication, narrowly scoped permissions and confirmation mechanisms that cannot be bypassed by less-trusted extensions.
Click Here For The Original Source.
