• 3 min read
Claude Chrome Extension Still Exposed to Synthetic Clicks
Security researchers say Claude for Chrome still lets synthetic clicks and a URL parameter trigger privileged AI workflows without approval.
Image: TechRadar
Anthropic’s Claude for Chrome extension remains vulnerable to attacks that can trigger sensitive workflows without genuine user approval, according to Manifold Security. The researchers say both flaws still work in version 1.0.80, released July 7, 2026, months after they first reported them to Anthropic.
Manifold submitted the vulnerabilities through Anthropic’s bug bounty program on May 21, 2026, and received acknowledgment the next day. The company later released eight versions, from 1.0.73 through 1.0.80, without changing the specific handlers the researchers had identified.
Synthetic clicks can trigger Claude workflows
The first vulnerability allows any browser extension to simulate a click on claude.ai and launch one of nine predefined Claude workflows. Researcher Ax Sharma found that the extension does not check the click event’s Event.isTrusted property before proceeding.
Recommended reading
Paidwork breach allegedly exposes 23 million users
Browsers mark synthetic clicks as untrusted, so the extension should reject them. Instead, it executes the requested workflow. The hardcoded tasks include:
- Reading Gmail
- Opening Google Docs
- Checking Google Calendar
- Modifying Salesforce leads
The flaw carries a CVSS score of 7.7 High under the default configuration. That rises to 9.6 Critical when users enable automatic execution, because Claude can then perform actions without requesting approval.
Manifold confirmed on July 7, 2026, that the exploit still worked against version 1.0.80. Anthropic closed the synthetic-click report, saying an existing internal report already covered the broader trust-boundary issue. Sharma said the specific bypass could be addressed with a single additional line checking isTrusted before the workflow continues.
skipPermissions enables privileged mode
The second weakness involves a side-panel URL parameter named skipPermissions. Setting it to true activates a privileged mode that skips permission checks and lets Claude act without a consent prompt.
Anthropic’s scheduled-task feature is currently the only system that is supposed to construct this type of privileged URL internally. However, the panel honors the parameter regardless of which script or page created the URL string.
One example workflow allows Claude to read a user’s Gmail inbox, identify promotional messages, and automatically click their unsubscribe links. Manifold said the bypass remains only six lines of JavaScript after the original report. Anthropic classified the second finding as informational, arguing that its internal systems are the only components that construct the parameter.
“The bypass is still six lines of JavaScript.”
Manifold said the relevant content-script and side-panel code remained byte-identical across the eight subsequent extension releases it examined. Researchers reproduced both flaws with Claude’s Opus, Sonnet, and Fable side-panel model selections, suggesting the weakness lies in the extension’s security design rather than in the underlying models.
The report linked the findings to OWASP LLM01: Prompt Injection and LLM06: Excessive Agency. It also warned that unauthorized AI actions can be difficult to detect because normal browser activity and network connections may appear unchanged.
Security Editor
Sophia unpacks the invisible wars happening on our networks. Covering cybersecurity, privacy legislation, and cryptography, she exposes how our data is weaponized and defended. Before joining for(geeks), she spent years as a penetration tester. She's the reason the rest of the team uses physical security keys.
via TechRadar
