Researchers say Claude for Chrome flaws let extensions trigger privileged AI actions

Anthropic’s Claude for Chrome extension contains two reported security flaws that could allow other browser code to trigger AI-powered workflows or bypass permission prompts, researchers at Manifold Security have claimed. The issues were still reproducible in extension version 1.0.80, released July 7, despite being disclosed to Anthropic in May, the researchers said.

The first issue concerns the way the extension responds to clicks on the Claude website. Manifold researcher Ax Sharma found that another browser extension could generate a synthetic click and use it to activate one of nine predefined Claude workflows. The Claude extension allegedly did not check the browser event’s isTrusted property, which distinguishes a genuine user interaction from an event created by software.

That missing validation matters because Claude’s browser integration can interact with other services on a user’s behalf. The affected workflows reportedly include tasks involving Gmail, Google Docs, Google Calendar and Salesforce. Depending on the workflow and the user’s settings, the assistant could read information or make changes through those services.

Manifold assigned the issue a CVSS severity score of 7.7 under the extension’s default configuration. Its assessment rose to 9.6 when automatic execution was enabled, because that setting could allow a triggered workflow to proceed without a separate approval step. CVSS is a standardized framework for rating vulnerability severity, although a researcher’s score does not necessarily reflect the software vendor’s own classification.

The second reported weakness involves a side-panel URL parameter named skipPermissions. Setting that parameter to true allegedly places the panel into a privileged state that omits normal consent checks. Anthropic’s scheduled-task system is currently intended to create URLs using that parameter, but Manifold argued that the panel accepts it without adequately establishing whether the URL came from a trusted internal source.

In one example described by the researchers, Claude could inspect a Gmail inbox, find promotional messages and follow unsubscribe links. Such activity could appear similar to legitimate browser use, potentially making unauthorized actions harder to identify from ordinary network traffic or browsing records.

Manifold said it submitted both findings through Anthropic’s bug bounty program on May 21 and received an acknowledgment the next day. The researchers reported that Anthropic closed the synthetic-click submission because a broader trust-boundary problem was already being tracked internally. Anthropic classified the skipPermissions report as informational, on the basis that its own systems were the only intended source of URLs carrying the parameter.

The researchers subsequently examined eight extension releases, from versions 1.0.73 through 1.0.80, and said the relevant content-script and side-panel code remained unchanged. On July 7, they confirmed that both techniques continued to work against version 1.0.80. Manifold characterized the necessary safeguards as small code changes, including a check that would reject click events not generated by a user.

The reported behavior was reproduced with the extension’s Opus, Sonnet and Fable model options. That consistency suggests the weaknesses reside in the browser extension’s authorization and event-handling logic rather than in the behavior of a particular Claude model.

The findings illustrate a broader security challenge for browser-based AI agents. Traditional extensions already operate within a sensitive environment containing authenticated sessions and personal data. Adding an assistant capable of taking multi-step actions raises the consequences of weak boundaries between websites, extensions and privileged agent functions. A malicious extension may not need to steal credentials directly if it can instead induce a trusted AI tool to act through an existing session.

Manifold linked the issues to risks identified by the Open Worldwide Application Security Project, including prompt injection and excessive agency. In agentic systems, permission checks must cover not only what a model is asked to do, but also which component initiated the request and whether the user actually authorized the resulting action. The researchers had not reported a patch in version 1.0.80.

Sources: Anthropic