Claude for Chrome Extension Remains Exploitable via Six-Line JavaScript Bypass, Researchers Say Despite Repeated Anthropic Warnings

• Flaws in Anthropic’s Claude extension permit fake clicks to initiate sensitive AI workflows
• Researchers observed vulnerable handlers left unchanged across eight extension updates
• Synthetic clicks circumvented safeguards meant to validate genuine user actions

Security researchers at Manifold Security report that Anthropic’s Claude for Chrome browser extension contains two unpatched vulnerabilities in version 1.0.80, which was released on July 7, 2026.

According to Manifold Security, the team initially disclosed both vulnerabilities to Anthropic via the company’s bug bounty program on May 21, 2026, and received confirmation of receipt the next day.

The first issue allows any browser extension to trigger nine predefined Claude workflows by simulating a synthetic user click on claude.ai.

Latest Videos From

Nine workflows and one missing check

Researcher Ax Sharma determined that the extension never verified whether a click event carried the Event.isTrusted property before responding to it.

Under default configuration, the vulnerability earned a CVSS score of 7.7 (High), rising to 9.6 (Critical) when users enabled automatic execution, since Claude could then act without explicit approval.

The nine hardcoded tasks include reading Gmail, opening Google Docs, checking Google Calendar, and modifying Salesforce leads without prompting.

Because browsers mark synthetic clicks as untrusted, the extension should have rejected them, yet it executed the workflows regardless.

Manifold Security confirmed on July 7, 2026, that both vulnerabilities remain functional against version 1.0.80, months after the initial disclosure to Anthropic.

Anthropic shipped eight separate versions between 1.0.73 and 1.0.80 without modifying the specific handlers researchers had flagged as vulnerable.

The company closed the synthetic-click report, stating an existing internal ticket already tracked the broader trust-boundary issue researchers had detailed.

However, Sharma contends the fix required only a single additional line of code to validate the click event’s isTrusted property before proceeding.

A second, structural weakness

A second flaw involves a side-panel URL parameter named skipPermissions, which can enable a privileged mode without any consent prompt.

When set to true, the panel ceases all permission checks, letting Claude operate without user confirmation.

Manifold notes that only Anthropic’s own scheduled-task feature is intended to construct such a privileged URL internally at present.

In practice, the panel honors that parameter irrespective of which script or page generated the originating URL.

One example task allows Claude to read a user’s Gmail inbox, detect promotional messages, and automatically click their unsubscribe links.

Manifold warns that “the bypass is still six lines of JavaScript,” months after the underlying issue was first reported to Anthropic.

Anthropic classified this second finding as informational, arguing the parameter is only ever built by its internal systems.

Manifold added that the content-script and side-panel code tied to both vulnerabilities stayed byte-identical across the eight releases reviewed after the original report.

The flaws were also reproduced across Claude’s Opus, Sonnet, and Fable side-panel model selections, showing the problem lies in the extension’s security design rather than the AI models.

The report further linked the findings to OWASP concerns around LLM01: Prompt Injection and LLM06: Excessive Agency in AI applications.

Researchers noted such AI tool abuse may evade detection, as normal browser activity and network traffic can appear unchanged while unauthorized AI actions take place.

Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds.

Source link