Threat · curated 14 Jul 2026
ClaudeBleed Reopened: Browser Extensions Can Still Push Claude for Chrome to Read Your Gmail
First reported · updated · 2 reports manifold.security
Coverage timeline
Why it matters
The Claude for Chrome flaw shows how an agentic browser assistant with authorized access to email, documents, and CRM can be silently coerced into acting by any co-installed extension, turning excessive agency into a data-exfiltration path with no user prompt.
Manifold Security researcher Ax Sharma disclosed two unpatched vulnerabilities in Anthropic's Claude for Chrome extension (v1.0.80). Any browser extension with a content script on claude.ai can inject a DOM element and dispatch a synthetic click that Claude treats as a legitimate user action, triggering one of nine hardcoded workflows that read Gmail, Google Docs, and Calendar or act on Salesforce; a second flaw initializes the side panel in privileged mode via a ?skipPermissions=true URL parameter with no consent. Rated CVSS 7.7 in default mode and 9.6 Critical when 'Act without asking' is enabled, and reportedly still reproducible after eight releases since being reported to Anthropic in May.
Summary
Researchers at Manifold Security disclosed that Anthropic's Claude for Chrome browser extension contains a trust-boundary flaw allowing any other browser extension able to run a content script on claude.ai to trigger the assistant's privileged tasks — including reading a victim's Gmail, latest Google Doc and comments, and Calendar. The flaw persists in v1.0.80, the current release, eight versions after Manifold first reported it against v1.0.72 in May 2026.[0][9]
The core weakness is that the extension's onboarding click handler never checks the browser's event.isTrusted flag, so a script-dispatched (synthetic) click on the #claude-onboarding-button element is honored as genuine user intent. This lets a rogue extension load one of nine allowlisted task IDs — including usecase-gmail, usecase-gdocs, and usecase-calendar — into the Claude side panel. Manifold rates the flaw CVSS 7.7 (High) in default 'ask before acting' mode and CVSS 9.6 (Critical) once a user enables 'Act without asking,' where the task runs silently.[0]
A second, deeper issue lets the side panel boot into skip_all_permission_checks when its URL carries ?skipPermissions=true, bypassing consent screens with only a retroactive red banner. This URL can currently only be built by the extension itself, so it is not remotely reachable today, but a future bug exposing that parameter could turn the forged-click trick into a fully silent account read. Anthropic acknowledged both reports on May 22, 2026 but closed them, and as of July 14, 2026 there was no CVE, no public advisory, and no patch.[0]
The findings extend a pattern of confused-deputy problems in the extension. The earlier ClaudeBleed flaw, disclosed by LayerX, allowed any extension — even one with zero permissions — to hijack Claude by exploiting the extension trusting the claude.ai origin rather than verifying which script was communicating with it; Anthropic's initial mitigation was found incomplete.[0][8]
Attack chain
- Prerequisite: The attacker requires a rogue browser extension already installed alongside Claude for Chrome, whose content script can reach the DOM on claude.ai. Both the forged-click flaw and ClaudeBleed depend on this precondition; the difference is scope.[0]
- Trigger via forged click: The rogue extension's content script builds the #claude-onboarding-button element, sets its data-task-id to an allowlisted task (e.g., usecase-gmail), and dispatches a synthetic click. Because the handler never checks event.isTrusted, the fake click (isTrusted: false in logs) is treated as a genuine user tap and an open_side_panel message carrying the task ID is sent. Manifold demonstrated this with six lines pasted into the claude.ai console.[0]
- Task execution: The Claude side panel opens with the matching prompt loaded. In default 'ask before acting' mode an approval box still stands between the forged click and any actual read. If the user has enabled 'Act without asking,' the usecase-gmail task runs silently with no prompt, reading the victim's mail, documents, and calendar.[0]
- Potential silent escalation: A separate latent issue lets the side panel boot into skip_all_permission_checks when its URL contains ?skipPermissions=true. Today only the extension can set this parameter, but a future URL-accepting message handler, panel-building regression, or XSS in the options page could expose it, converting the forged-click trick into a fully silent account read.[0]
Disclosure timeline
| Date | Event |
|---|---|
| Late April 2026 | ClaudeBleed begins: LayerX finds Claude for Chrome trusts the claude.ai origin instead of verifying which script is talking to it, enabling a zero-permission extension to drive the assistant.[0][8] |
| May 7, 2026 | LayerX publishes the ClaudeBleed disclosure, characterizing it as a confused-deputy problem; Anthropic said it was already aware and would fix it in the next version, but issued only a partial fix.[8] |
| May 2026 | Anthropic restricts the arbitrary-prompt path as part of its ClaudeBleed response, boxing external callers into nine fixed task IDs.[0] |
| May 21, 2026 | Manifold Security reports both the forged-click and skipPermissions issues against v1.0.72.[0][9] |
| May 22, 2026 | Anthropic acknowledges both issues the next day, then closes them — the forged-click report on the grounds the underlying trust-boundary problem was already tracked under ClaudeBleed, and the URL report as informative.[0] |
| Before June 9, 2026 | The internal report meant to cover the fix was marked resolved.[0] |
| July 7, 2026 | Manifold checks v1.0.80 and finds the content-script click handler and side-panel initialization byte-for-byte identical to v1.0.72; The Hacker News independently unpacks v1.0.80 from the Chrome Web Store (updated July 7) and confirms both mechanisms across all 90 JavaScript bundles.[0][12] |
| July 14, 2026 | As of publication, no CVE exists for either issue, Anthropic has published no public advisory or response to Manifold's findings, and no patch has shipped.[0] |
How it works
After ClaudeBleed, Anthropic replaced the arbitrary-prompt path with an allowlist of nine fixed task IDs baked into the extension bundle — three onboarding practice prompts, three for DoorDash/Salesforce/Zillow, and usecase-gmail, usecase-gdocs, and usecase-calendar, which read mail, the latest doc and its comments, and the calendar. The page can no longer inject arbitrary text into Claude, but the trigger that fires a task remains weak.[0]
A content script listens on claude.ai for a click on the #claude-onboarding-button element, reads its data-task-id, and if the ID is allowlisted sends the extension an open_side_panel message carrying it, opening the panel with the matching prompt. The handler never checks event.isTrusted, the browser flag distinguishing a real user click from a script-dispatched one. Any extension whose content script can reach the DOM on claude.ai can therefore build the element, set the task ID, and dispatch a synthetic click that the extension treats as genuine — Manifold showed this with six console lines and isTrusted: false in the logs.[0]
The second issue: when the side panel loads with ?skipPermissions=true in its URL, it boots straight into skip_all_permission_checks and acts without asking, with a red warning banner appearing only after the privileged session is already running. Currently only the extension itself can build that URL, so there is no direct remote path, but a URL-accepting message handler, a panel-building regression, or an XSS flaw in the options page could expose the parameter to a lower-privileged context. Manifold maps the working attack to indirect prompt injection and the silent-execution risk to excessive agency in the OWASP Top 10 for LLM apps, and notes the bug is in the extension rather than the model, reproducing under Opus, Sonnet, or Fable.[0]
The proposed fixes are a one-line rejection of synthetic clicks at the top of the click handler, and booting the panel in ask mode every time rather than reading permission mode from the URL.[0]
Affected versions and patch status
| Product | Affected | Patch status |
|---|---|---|
| Claude for Chrome browser extension | v1.0.72 through v1.0.80 (current release as of July 14, 2026); labeled a beta and available to all paid Claude subscribers | No patch as of July 14, 2026; the vulnerable click handler and side-panel initialization are byte-for-byte identical between v1.0.72 and v1.0.80. No CVE and no Anthropic advisory published.[0][12][13] |
Key takeaways
- A permission allowlist is not a security boundary if the mechanism that selects an allowlisted action can be forged. Anthropic's post-ClaudeBleed fix constrained what could be requested (nine task IDs) but left the trigger honoring synthetic, untrusted clicks, so a rogue extension can still invoke sensitive Gmail, Docs, and Calendar tasks.[0]
- Reading a privileged permission mode from a URL parameter (skipPermissions=true) is a latent bypass: it is safe only as long as no other component can set that parameter, making the extension one URL-handling or XSS regression away from fully silent account reads.[0]
- Vendor triage status can obscure real risk: Anthropic closed both reports (one as a duplicate of the still-open ClaudeBleed tracking, one as informative) and marked the internal fix resolved, yet eight releases later the vulnerable code is byte-for-byte unchanged and no fix, CVE, or advisory exists.[0]
- Browser-resident AI agents concentrate risk: an agent signed into a user's accounts becomes a confused deputy that any co-installed extension able to reach its origin can drive, extending the same class of trust-boundary failure seen in ClaudeBleed and earlier Claude extension flaws.[0][8]
Defensive actions
- Disable the 'Act without asking' automation mode in Claude for Chrome.: With hands-off automation enabled, a forged click loads and runs a task silently with no approval prompt (CVSS 9.6). Turning it off restores the approval step, though it does not remove the forged-click path.[0]
- Review and remove any browser extension with permission to read or change data on claude.ai.: Exploitation requires a rogue extension whose content script can reach the DOM on claude.ai; auditing such extensions reduces the attack surface for both this flaw and ClaudeBleed.[0]
- Treat Claude for Chrome as an untrusted beta and limit exposure of signed-in sensitive accounts (Gmail, Docs, Calendar).: Anthropic labels the extension a beta open to all paid subscribers; placing an AI agent with signed-in accounts in the browser lets another extension drive the capabilities Claude exposes within the fixed task set and approval mode.[0][13]
- Monitor for a future Anthropic patch, CVE, or advisory before relying on the extension for sensitive workflows.: As of July 14, 2026 there is no patch, no CVE, and no public Anthropic response; whether 'resolved' means a fix is coming or a risk-acceptance call cannot be determined externally.[0]