Manifold reports that two critical vulnerabilities in Anthropic's Claude for Chrome remain exploitable, allowing rogue extensions to read Gmail, Google Docs and calendar entries. The risk escalates when users enable the autonomous "Act without asking" mode.
Key Takeaways
- Two unpatched flaws persist in Claude for Chrome
- Malicious extensions can read Gmail, Docs, and Calendar
- Risk intensifies when "Act without asking" mode is enabled
Cyber‑security firm Manifold has disclosed that the agentic browser extension Claude for Chrome, developed by Anthropic, still harbors two exploitable vulnerabilities. First reported in May 2024, the weaknesses have survived eight subsequent releases—including the current 1.0.80 version—without an effective fix.
How the Flaws Work
The root cause traces back to an earlier patch Anthropic rolled out earlier this year to mitigate a similar issue dubbed “ClaudeBleed.” That patch limited which prompts an external webpage could feed into Claude, restricting the extension to a predefined set of pre‑approved tasks. Manifold discovered that the activation mechanism does not verify whether a click originates from a real user, allowing another extension to spoof the interaction and trigger Claude’s actions.
User‑Facing Impact
In the default configuration, the exploit triggers a confirmation dialog before any sensitive operation proceeds, giving the victim a chance to block the attack. However, when users enable the more autonomous “Act without asking” mode, the malicious extension can proceed silently, gaining access to Gmail messages, Google Docs files, and calendar entries.
Secondary Design Gap
Manifold also identified a related design gap: Claude’s side‑panel can be launched directly into the no‑confirmation state via a parameter embedded in its own URL, without any user action. While currently only the extension itself can construct that URL, the researchers warn that any future script capable of influencing the URL generation could hand attackers silent control over a user’s linked Google accounts.
Implications and Recommendations
Manifold reported its findings to Anthropic on May 21, shortly after the public disclosure of ClaudeBleed research. Anthropic described the pre‑approved task list as an interim mitigation, but Manifold says none of the eight versions released since have addressed the vulnerabilities. Security experts advise users to keep the autonomous mode disabled, regularly audit extension permissions, and demand prompt patches from the vendor.
