Claude for Chrome extension vulnerabilities remain unpatched, researchers claim

Security researchers have alleged that two vulnerabilities in Anthropic’s Claude for Chrome browser extension remain unpatched despite being reported to the company several months ago. According to Manifold Security, both issues remain in version 1.0.80 of the extension, released on 7 July 2026.

The researchers said they initially disclosed the vulnerabilities to Anthropic through its bug bounty programme on 21 May 2026. The company acknowledged receipt of the report the following day, but Manifold Security claims the identified weaknesses remain exploitable in the latest release.

Researchers highlight synthetic click vulnerability

The first reported vulnerability centres on how the Claude for Chrome extension processes browser click events. According to Manifold Security researcher Ax Sharma, the extension fails to verify whether a click originated from a genuine user interaction before carrying out specific actions.

Modern browsers distinguish legitimate user clicks from artificially generated ones using the Event.isTrusted property. Security experts explained that extensions should reject synthetic clicks for sensitive operations. However, the researchers claim Claude’s extension proceeds with predefined workflows without performing this verification, potentially allowing another browser extension to trigger actions automatically.

Manifold Security stated that the vulnerability could be exploited to activate nine built-in Claude workflows. These reportedly include accessing Gmail, opening Google Docs, checking Google Calendar and modifying Salesforce leads. Under the extension’s default settings, the issue received a Common Vulnerability Scoring System (CVSS) rating of 7.7, classified as High. Researchers said the severity increases to 9.6, rated Critical, if users enable automatic execution because the assistant can complete actions without requiring further approval.

The researchers tested version 1.0.80 after its release on 7 July and reported that the vulnerability remained functional. According to their analysis, Anthropic published eight extension updates between versions 1.0.73 and 1.0.80, but the relevant event handlers identified in the original report were unchanged.

Anthropic reportedly closed the synthetic click vulnerability report, stating that an existing internal report already covered the broader trust boundary issue described by the researchers. Sharma, however, argued that the problem could be resolved with a simple validation check. He said the required fix involved verifying the click event’s isTrusted property before allowing any workflow to proceed.

The second flaw involves permission bypass

The second reported vulnerability concerns a side-panel URL parameter called skipPermissions. According to Manifold Security, setting this parameter to “true” allows the extension to bypass permission prompts and enter a privileged operating mode.

The researchers explained that Anthropic’s scheduled task feature is currently intended to generate this parameter internally. However, they claim the extension accepts the parameter regardless of where the URL originates, potentially allowing external scripts or pages to trigger privileged behaviour.

One demonstration showed Claude reading a user’s Gmail inbox, identifying promotional emails, and automatically selecting unsubscribe links without requesting the user’s permission. Manifold Security argued that this behaviour could allow actions to be performed without the user’s knowledge if the vulnerability were abused.

Anthropic reportedly classified this second finding as informational rather than a security vulnerability. The company argued that the parameter is generated only by its own internal systems. However, the researchers disputed that assessment, maintaining that the extension should verify the parameter’s origin before accepting it.

Sharma summarised the issue by stating, “the bypass is still six lines of JavaScript,” suggesting that exploiting the weakness requires only a small amount of code even months after the initial disclosure.

Findings raise wider concerns over AI browser security

Beyond the two individual vulnerabilities, Manifold Security said its analysis showed that the affected content script and side-panel code remained byte-identical across all eight extension releases published after the original report. According to the researchers, this indicates that the identified security mechanisms were not modified during subsequent updates.

The researchers also tested the vulnerabilities using Claude’s Opus, Sonnet and Fable side-panel model options. They reported that the flaws could be reproduced across AI models, suggesting the weaknesses stem from the extension’s overall security architecture rather than the language models themselves.

The report linked the findings to the Open Worldwide Application Security Project (OWASP) guidance on securing large language model applications. Specifically, the researchers referenced LLM01, which covers prompt injection, and LLM06, which addresses excessive agency, where AI systems perform actions beyond appropriate limits.

According to Manifold Security, browser-based AI assistants introduce new security challenges because malicious activity may resemble normal browsing behaviour. Since network traffic and browser interactions can look legitimate, unauthorised AI actions could be more difficult for users and security software to detect.

The researchers argue that stronger validation of user interactions and permission controls will become increasingly important as AI assistants gain deeper integration with web browsers and online services.