In a nutshell: Manipulated browser extensions can trick the Claude extension into performing actions in Gmail, Google Docs, and Calendar contexts, which Manifold Security has reproduced since May and Anthropic has yet to fix.
Two security vulnerabilities in Anthropic’s Claude extension for Chrome remain unfixed since May. Through them, malicious browser extensions can generate synthetic clicks and cause Claude to read emails, documents, and calendar entries — potentially without user consent.
Manifold Security has identified two vulnerabilities in Claude’s Chrome extension that exist in versions 1.0.73 through 1.0.80 (latest known version from July 7). Although the researchers reported the vulnerabilities as early as May 2024, the current version 1.0.80 contains byte-identical code sections in content script and side-panel handlers as the version 1.0.72 tested at that time. Anthropic temporarily marked the internal tracking ticket as resolved but then shipped multiple updates without actual security fixes.
The first vulnerability affects click verification: Claude’s click handler does not check whether a click originates from genuine user input (event.isTrusted property). A malicious browser extension can therefore inject synthetic clicks that Claude accepts as legitimate. In default mode, this opens an attack that triggers Claude’s predefined browser tasks before any dialog appears. If the user has enabled the “Act without asking” setting, attackers can perform silent actions and read Gmail contents, Google Docs, or calendar entries. The fix would be trivial: a single line of code at the beginning of the handler — “if (!n.isTrusted) return;” — would have sufficed.
The second problem lies in side-panel initialization: a URL parameter “?skipPermissions=true” puts the extension into a privileged mode that bypasses repeated confirmations. While the researchers identified no direct external path to control this parameter today, the architecture creates a latent risk: privileged behavior depends on the URL value, not on user control. Future security vulnerabilities could misuse this parameter and inherit elevated privileges without undergoing additional checks.
Manifold recommends validating genuine user interactions before executing privileged actions, avoiding URL-based privilege escalation, and strengthening authentication of internal extension workflows. Anthropic has not responded to requests for comment. The incident is reminiscent of the ClaudeBleed disclosure, in which Anthropic also announced a public fix but the vulnerability remained exploitable.
Source: www.csoonline.com · Published July 15, 2026
Lumi AI News — AI-assisted curation in accordance with Art. 50 EU AI Act. Paraphrasing and classification by Lumi News Pipeline v1.7.3.