A security vulnerability in Anthropic’s Claude for Chrome has the potential to allow malicious browser extensions to initiate tasks in Gmail, Google Docs, and Google Calendar under specific circumstances.
Researchers from Manifold Security discovered that certain extensions could exploit flaws in the way Claude for Chrome verifies user interactions. While users who rely on default approval prompts maintain a degree of protection, those who have enabled the “Act without asking” feature face considerably higher risks of unauthorized account access.
Synthetic clicks can trigger trusted Claude tasks
The primary flaw pertains to how Claude for Chrome assesses whether a user has clicked a button prior to executing a task.
According to The Hacker News, a content script running on claude.ai is programmed to listen for clicks on a designated page element. This handler verifies whether the selected task is on an approved list; however, it fails to check if the click is initiated by a person or generated by an automated script.
A malicious extension with permission to run scripts on claude.ai could produce the necessary element and simulate a click. Consequently, Claude for Chrome would interpret this synthetic action as an authentic user request.
Anthropic had previously restricted external calls to nine predefined tasks following the preceding ClaudeBleed revelation. Three of these tasks can access Gmail, retrieve the latest Google Doc along with its comments, or connect to Google Calendar.
While this limitation reduces the number of commands an attacker could potentially trigger, it raises a crucial question regarding the true origin of those commands.
According to Malwarebytes, Manifold Security indicated that the vulnerability remains reproducible in version 1.0.80, released on July 7. The researchers pointed out that despite eight subsequent releases, the bypass exploit still consists of a mere six lines of JavaScript.
Unattended mode raises the stakes
Typically, Claude for Chrome requires user approval before accessing account data or performing actions. The “Act without asking” feature eliminates this safeguard.
Manifold Security assigned a CVSS score of 7.7, denoting high severity, to the synthetic-click vulnerability under its default settings. When the unattended mode is enabled, this score escalates to 9.6, marking it as critical severity because an approved task can execute without further prompts.
CSO highlighted another critical finding regarding the ?skipPermissions=true URL parameter utilized when initiating Claude’s side panel. Activating this parameter places the extension in a state that forgoes repeated approval checks.
Although researchers didn’t identify a direct external method for manipulating the parameter, they cautioned that storing sensitive states in a URL could pose risks, especially if another vulnerability arose that allowed an attacker some control over that value.
Manifold recommended rejecting synthetic clicks, avoiding URL-driven privilege changes, and enhancing internal authentication mechanisms within the extension. CSO reported that Anthropic had not immediately responded to inquiries for comment.
Browser agents complicate extension security
These vulnerabilities do not exploit Chrome itself but rather leverage the permissions users have already granted to Claude for Chrome, coupled with the extension’s failure to accurately ascertain the request’s origin.
This distinction is essential for businesses.
Traditional reviews of extensions typically focus on the permissions assigned to individual tools. However, AI browser agents introduce an additional layer of risk, as other extensions can activate an agent that already has extensive privileges in accessing emails, documents, calendars, or content from logged-in business applications.
IT teams evaluating Claude for Chrome should disable the “Act without asking” feature, audit extensions with access to data on claude.ai, and restrict the accounts available to browser-based AI tools. Organizations that handle sensitive communications or regulated data might consider disabling the beta extension until Anthropic offers a more robust fix.
While approval prompts can mitigate immediate risks, they do not comprehensively address the underlying trust model. As AI browser agents gain deeper access to emails, documents, and business applications, organizations will require advanced controls to ensure not only that an assistant has permission to act but also that the request genuinely originated from the user.
More news: Explore how hackers are exploiting Claude Code and the potential implications for Australian enterprises facing new security risks.
