Anthropic Claude Extension Security Gaps

Users of the Claude for Chrome browser extension may be exposed to unauthorized task execution if they run other browser extensions capable of interacting with the claude.ai domain. Despite earlier efforts to restrict external access to the assistant, researchers have identified that the current build, v1.0.80, still processes synthetic clicks as legitimate user input.

The Forged Click Mechanism

Following the disclosure of the ClaudeBleed vulnerability, Anthropic restricted the extension to a set of nine predefined tasks. These allowlisted operations include tasks that access Gmail, Google Docs, and calendar data. While this approach limits what an attacker can command the AI to do, the flaw lies in how the extension initiates these tasks.

A content script inside the extension monitors the webpage for clicks on a specific element. It identifies the intended operation by reading the data-task-id attribute but fails to verify the event.isTrusted browser flag. Consequently, any other malicious browser extension with access to the claude.ai DOM can programmatically dispatch a synthetic click that the Claude extension accepts as a genuine user action.

Risks of Automated Mode

The impact of this vulnerability depends heavily on the user's configuration of the extension. In the default setting, the application requires manual approval before executing a task. However, if a user has enabled the Act without asking mode, the forged request triggers execution immediately without any visible prompt.

• CVSS 7.7 High: The severity rating assigned to the flaw when the extension is in its default approval-required mode.
• CVSS 9.6 Critical: The severity rating applied when a user has enabled the automated Act without asking mode.
• Eight: The number of software releases that have occurred since the issues were first reported on May 21, 2026.

URL Parameter Vulnerability

A second security concern involves the initialization of the extension's side panel. The panel checks the URL for a skipPermissions=true parameter; if present, the extension bypasses standard permission checks. While this path currently cannot be triggered remotely, security researchers warn that any future bug—such as an XSS flaw or an improper message handler—that allows an attacker to manipulate this URL could result in fully silent account access.

Ongoing Development Status

Manifold Security reported these findings to Anthropic on May 21, 2026, regarding version v1.0.72. Anthropic closed the reports, citing previous work related to the ClaudeBleed flaw. However, analysis of the v1.0.80 update released on July 7, 2026, confirms that the vulnerable click-handling code and the permission-bypass logic remain unchanged in the production build.

The persistence of these gaps underscores the complexity of managing AI agent security within the browser environment. For users, the most immediate defense is to disable the Act without asking feature and audit all installed browser extensions that hold permissions to read or modify data on claude.ai. Until a patch is issued, the extension remains in a state that allows external scripts to manipulate its internal task queue.