Critical Claude for Chrome Flaw Lets Malicious Extensions Access Gmail, Docs, Calendar

Anthropic’s Claude for Chrome extension contains two high-risk flaws that allow a malicious browser extension to trigger AI-driven actions against a victim’s Gmail, Google Docs, and Google Calendar data, researchers warn, and the issues remain reproducible in version 1.0.801.0 released on July 7, 2026 despite being reported months earlier.

At the heart of the first vulnerability is a content script that listens for clicks on elements matching the #claude-onboarding-button selector, reads a data-task-id attribute, and forwards one of nine allowlisted prompts to the Claude side panel;

Because the click handler does not verify whether the event originated from genuine user interaction, an attacker with script access to claude.ai can inject a matching DOM element, set an approved task ID, and dispatch a synthetic click event that Claude will treat as user intent.

Critical Claude for Chrome Flaw

Manifold Security researcher Ax Sharma demonstrated that, because the handler fails to check the browser event’s isTrusted property, a programmatically generated event can populate the side panel with tasks that include reading recent Gmail messages, identifying promotional emails, opening and reviewing comments in the user’s most recent Google Doc, checking calendar availability, and creating meetings.

Other permitted tasks reach beyond Google services to interact with third parties such as Salesforce, DoorDash, and Zillow. The attack surface widens dramatically when users enable Claude’s “Act without asking” mode.

In that configuration the extension will execute the invoked task without prompting for approval, creating a silent and automated pathway for data access and action execution.

Manifold assigned the synthetic-event issue a CVSS score of 7.7 in the default “Ask before acting” configuration and 9.6 when unattended execution is allowed, and emphasized that the flaw lies in the browser extension’s trust boundary rather than the Claude model itself;

The issue reproduces across multiple side-panel model selections, including Opus, Sonnet, and Fable. The second vulnerability concerns privileged-mode initialization:

Researchers found that when the Claude side panel is loaded with a ?skipPermissions=true URL parameter it initializes with skip_all_permission_checks, effectively enabling “Act without asking” without an explicit user gesture or consent.

Although this parameterized initialization is not remotely exploitable in version 1.0.801.0 because constructing the required side-panel URL currently requires extension-level privileges.

Manifold warned it represents a dangerous architectural weakness, any future flaw that allows arbitrary URL construction, a same-extension cross-site scripting (XSS) bug, or an exposed message handler could convert it into a reliable vector for silent execution.

To mitigate these issues, the researchers recommend that Anthropic reject synthetic events by checking event.isTrusted in click handlers, remove URL-parameter-based permission initialization, start panels in approval mode by default, and require explicit user-driven permission transitions for changes in execution privileges.

Both problems map to OWASP’s LLM security categories, indirect prompt injection and excessive agency, and, although Anthropic reported that it closed the disclosures.

Manifold observed that the relevant code paths have remained unchanged across eight extension updates, leaving users and enterprises exposed until a robust fix is deployed.

Organizations using Claude for Chrome should audit extension permission boundaries, disable unattended automation modes where possible, and apply strict extension policies while awaiting a permanent remediation from Anthropic.