# Unpatched Claude for Chrome Flaw Persists Through Eight Updates, Exposing Gmail and Calendar to Malicious Extensions
A critical vulnerability in Anthropic's Claude for Chrome browser extension has remained exploitable across eight patches, according to findings from AI security firm Manifold. The flaw allows malicious extensions to impersonate user actions and gain unauthorized access to sensitive data including Gmail messages, Google Docs, and calendar entries—without triggering any user confirmation.
## The Threat
Security researchers at Manifold have identified two related vulnerabilities in Claude for Chrome that circumvent Anthropic's previously deployed safeguards. The vulnerabilities enable a malicious browser extension to trick Claude into performing actions on a user's behalf, effectively hijacking their connected Google accounts.
The attack operates through a fundamental gap in how Claude for Chrome verifies user intent. Rather than confirming that a click or action genuinely originated from the user, the extension's activation mechanism can be spoofed by other installed extensions. This means an attacker doesn't need to compromise Claude itself—they only need to deploy a malicious companion extension that can trigger Claude's functionality without legitimate user interaction.
The two critical flaws are:
1. Fake Click Injection — A malicious extension can forge the interaction signals that Claude uses to activate its pre-approved task list, bypassing the normal click verification
2. URL Parameter Bypass — Claude's side panel can be launched directly into autonomous mode through a specially crafted URL parameter, potentially allowing silent access if an attacker can influence URL construction
## Background and Context
This vulnerability is a direct descendant of ClaudeBleed, a vulnerability disclosed earlier in 2026 that exposed Claude for Chrome users to prompt injection attacks. ClaudeBleed allowed external websites to feed arbitrary prompts directly into Claude, potentially instructing the extension to perform unauthorized actions on a user's behalf.
In response to ClaudeBleed, Anthropic implemented what it described as an interim mitigation: a whitelist of pre-approved tasks that Claude could perform without accepting arbitrary prompts from websites. The company intended this restriction to serve as a stopgap measure until a more comprehensive fix could be developed and deployed.
However, Manifold's research reveals that this interim fix has a fundamental architectural flaw. The mechanism that activates these pre-approved tasks doesn't properly verify the legitimacy of the trigger event. As a result, any browser extension with sufficient privileges—which includes most extensions—can simulate a user interaction and unlock the pre-approved actions.
"Anthropic described the pre-approved task list as an initial mitigation until a complete fix is rolled out," Manifold noted in its research disclosure. "However, none of the eight versions released since May have patched these vulnerabilities, including the latest version 1.0.80."
## Technical Details
To understand how this exploit works, it's important to know how Claude for Chrome is architected:
Normal Operation:
Attack Scenario:
The Two Attack Vectors:
The first vulnerability is the fake click injection described above. By spoofing the browser events that normally indicate a user has clicked a button, a malicious extension can trigger Claude's pre-approved actions. This is particularly dangerous because browser extensions have deep access to the browser's event system and can forge interaction signals that appear legitimate to the extension.
The second vulnerability involves a design flaw in how Claude's side panel initializes. The panel can be opened in autonomous mode—skipping all confirmation prompts—based on a URL parameter. While Manifold notes that "only the extension itself is meant to construct that URL," the researchers correctly identify this as a structural risk: any future vulnerability that allows external code to influence URL construction could grant silent control.
## Impact and Affected Users
Who is at risk?
Any user with Claude for Chrome installed is potentially vulnerable, particularly if they:
What data can be exposed?
An attacker exploiting these vulnerabilities could:
Attack feasibility:
These vulnerabilities are highly practical to exploit. An attacker would need only to distribute a seemingly benign browser extension through the Chrome Web Store or through social engineering. The extension could remain dormant until it detects Claude for Chrome, at which point it could silently extract data without the user's knowledge.
## Implications for Organizations and Users
This vulnerability represents a significant risk for several reasons:
Enterprise Risk: Organizations that mandate the use of Claude for Chrome for employee productivity face potential data exfiltration risks. A single malicious browser extension could compromise multiple employee accounts.
Supply Chain Exposure: The vulnerability demonstrates how browser extensions—which can be distributed through legitimate marketplaces—can be weaponized to attack other tools. Users may not realize that an installed extension they trust could be spying on their interactions with Claude.
Design Pattern Risk: The underlying issue reveals a troubling pattern in how browser extensions interact. Extensions have such deep browser access that they can forge user interactions, making it difficult to distinguish legitimate from fraudulent clicks.
Verification Bypass: Most security models assume that clicks and user interactions are trustworthy signals. This vulnerability demonstrates that such assumptions are flawed in the browser extension environment.
## Recommendations
For Users:
For Organizations:
For Anthropic:
## HackWire Analysis
This vulnerability exposes a critical flaw in how major AI vendors approach security in browser extensions—they're treating user intent verification as a low-priority concern, and it's costing users real security. What's most alarming here isn't just that the vulnerability persists; it's that Anthropic has released eight patches without addressing the fundamental issue, suggesting either misunderstanding of the problem's root cause or deprioritization of the fix.
The pattern is familiar: deploy a quick mitigation (the pre-approved task list), declare it solved, move on to new features. But as Manifold demonstrated, the mitigation was never the solution—it was security theater. The real issue is that Claude for Chrome's entire activation mechanism lacks proper user intent verification. Browser extensions have been forging clicks since the extension platform existed, and Anthropic appears to have built its security model without accounting for this reality.
This also reflects a broader trend in AI tooling: velocity and feature-parity are winning over security architecture. Companies rushing to integrate Claude into workflows are bolting on extensions and features faster than the underlying permission and verification systems can handle. We're seeing this across AI coding assistants, which have been similarly compromised through prompt injection and browser-based attacks.
The timeline is telling: disclosed May 21, eight patches released, still broken as of July 14. That's nearly two months of iterations without fixing the core flaw. For users processing sensitive information through Claude—financial data, code containing API keys, confidential business documents—this represents unacceptable risk. Until Anthropic ships a fundamental architectural fix (not another mitigation), organizations should treat Claude for Chrome as unsafe for any sensitive browser data. — HackWire Editorial
## Related Coverage