Users of Claude for Chrome may still be exposed to security risks if they have another browser extension capable of injecting scripts into claude.ai, according to new findings from security researchers at Manifold Security.
Although Anthropic addressed the original ClaudeBleed vulnerability earlier this year, researchers claim that a related weakness remains in the latest extension release (v1.0.80), allowing malicious browser extensions to trigger sensitive Claude tasks involving Gmail, Google Docs, and Google Calendar.
What’s the Issue?
Following the disclosure of ClaudeBleed, Anthropic limited external requests to a fixed list of nine predefined tasks instead of allowing arbitrary prompts. This significantly reduced the attack surface.
However, Manifold Security says attackers can still exploit the extension by simulating a user click that launches one of these approved tasks.
The tasks include:
- Gmail access
- Reading your latest Google Doc and its comments
- Google Calendar actions
- Several onboarding and third-party integration tasks
While attackers cannot inject custom prompts anymore, they can still trigger these built-in actions under certain conditions.
How the Attack Works
The vulnerability centers on how the extension detects user interaction.
A content script running on claude.ai listens for clicks on a specific HTML element. When clicked, it reads a predefined task ID and opens Claude’s side panel with the corresponding action.
The problem is that the extension does not verify whether the click came from a real user.
Security researchers found that another browser extension with permission to interact with claude.ai can:
- Create the required HTML element.
- Assign one of the approved task IDs.
- Generate a fake click event.
Because the extension fails to check whether the click is genuine, it treats the synthetic event as legitimate and launches the selected task.
Researchers demonstrated the exploit using only a few lines of JavaScript, confirming that browser-generated clicks were accepted without additional validation.
Does User Approval Still Protect You?
For most users, yes—but only partially.
By default, Claude for Chrome operates in “Ask Before Acting” mode. In this configuration, the extension still displays an approval dialog before accessing Gmail, Google Docs, or Calendar.
The attack can trigger the request, but the user must still approve it manually.
The situation becomes more serious for users who have enabled “Act Without Asking.”
In this mode:
- No confirmation dialog appears.
- Approved tasks execute automatically.
- Sensitive information may be accessed without any visible prompt.
Manifold Security rates the issue as:
- CVSS 7.7 (High) when manual approval is enabled.
- CVSS 9.6 (Critical) when “Act Without Asking” is turned on.
A Simple Fix That Hasn’t Been Released
According to the researchers, preventing the attack requires only a small change.
The extension should verify the browser’s event.isTrusted property before accepting a click. This property distinguishes genuine user interactions from events generated by scripts.
As of July 14, Manifold reports that this validation had not been added to the extension.
A Second Permission Bypass Concern
Researchers also identified another issue involving the extension’s permission handling.
When Claude’s side panel launches with the URL parameter:
?skipPermissions=true
the extension immediately switches into a mode that skips permission checks and begins operating without requesting user approval.
Currently, external websites cannot directly trigger this behavior because only the extension itself generates the parameter.
However, researchers warn that if a future vulnerability ever allows attackers to manipulate that URL, the permission system could potentially be bypassed entirely.
Their recommendation is straightforward:
- Ignore permission settings passed through the URL.
- Always launch the extension in “Ask Before Acting” mode.
Timeline of the Disclosure
Manifold Security reported both vulnerabilities to Anthropic on May 21 while testing version 1.0.72.
Anthropic acknowledged the reports the following day.
The company later:
- Closed the forged-click report, stating it was already covered under the broader ClaudeBleed investigation.
- Classified the permission URL issue as informational.
Despite those responses, researchers say the underlying code remains unchanged.
After examining version 1.0.80, released on July 7, they found that both vulnerable components were effectively identical to those originally reported.
Independent Verification
The Hacker News independently reviewed the current extension package from the Chrome Web Store.
According to its analysis:
- The onboarding click handler still accepts synthetic clicks without validating whether they originated from an actual user.
- The side panel continues to read the
skipPermissionsparameter from its URL and can enter permission-bypass mode when it is present.
As of July 14, researchers noted that:
- No public CVE has been assigned.
- Anthropic has not released a public security advisory addressing these findings.
A Pattern of Browser Extension Risks
This is not the first security issue affecting Claude for Chrome.
Earlier this year:
- Another vulnerability allowed websites to inject prompts into the extension.
- The original ClaudeBleed attack demonstrated that browser extensions could abuse Claude’s authority through a classic “confused deputy” scenario.
Researchers say the latest findings continue to highlight the importance of strong trust boundaries between browser extensions and web pages.
How Users Can Reduce Their Risk
Until Anthropic releases an update, users can lower their exposure by:
- Keeping “Ask Before Acting” enabled.
- Disabling “Act Without Asking.”
- Reviewing browser extensions that have permission to read or modify data on claude.ai.
- Removing unnecessary extensions with broad website permissions.
While these measures do not eliminate the underlying vulnerability, they add an important approval step that can prevent silent execution of sensitive tasks.
Final Thoughts
Anthropic’s earlier mitigation successfully blocked arbitrary prompt injection by limiting Claude to a predefined set of approved actions. However, Manifold Security argues that the remaining implementation still allows malicious browser extensions to trigger those actions by simulating user clicks.
Whether Anthropic considers the remaining risk acceptable or plans to issue another security update remains unclear. For now, users relying on Claude for Chrome should review their browser extensions and avoid enabling unattended automation unless absolutely necessary.
