Claude Extension Bypass Stays Open

Ongoing Risks in Browser Integration

The security architecture of browser-based AI assistants is facing renewed scrutiny as researchers from Manifold Security highlight persistent vulnerabilities within the official Claude extension for Chrome. Despite initial reports submitted to Anthropic months ago, findings indicate that critical pathways for unauthorized actions remain accessible, potentially allowing external scripts to trigger sensitive operations without genuine user intent.

The Mechanics of Synthetic Clicks

The primary concern involves the extension’s failure to differentiate between legitimate user interactions and synthetic events. By ignoring the Event.isTrusted property, the extension processes clicks as if they were initiated by the user, even when generated by other browser extensions. This oversight creates a high-risk vector for automated abuse, particularly when the extension is configured to allow automatic workflow execution.

• 9 predefined workflows are accessible via synthetic clicks, including Gmail and Google Docs access.
• 7.7 is the base CVSS score for the vulnerability, rising to 9.6 when automatic execution is enabled.
• 8 separate versions of the extension were released between 1.0.73 and 1.0.80 without addressing the flagged code.

Bypassing Permission Constraints

Beyond synthetic clicks, the extension contains a secondary weakness linked to a skipPermissions URL parameter. When this parameter is active, the side panel bypasses necessary consent prompts, granting the AI privileged access to perform tasks. While the vendor argues that this parameter is intended for internal system use, researchers contend that the side panel lacks the validation required to verify the origin of these requests.

The bypass is still six lines of JavaScript.

— Manifold Security, in a report detailing the persistent nature of the flaws found in the Claude browser extension.

Broader Implications for AI Agency

The persistence of these vulnerabilities raises significant questions regarding the intersection of LLM06: Excessive Agency and standard browser security practices. Because unauthorized AI actions often mirror legitimate network and browser activity, identifying active exploitation remains a difficult task for end users. The case underscores the necessity for rigorous trust-boundary verification in AI-integrated tools, where the cost of a simple coding omission can lead to widespread data exposure or unauthorized automated actions. Organizations relying on such extensions must weigh the utility of AI-driven automation against the potential for high-severity security lapses that persist despite formal bug reports.