Researcher finds Claude for Chrome extension flaw letting malicious sites trigger AI actions
The extension did not check the browser's isTrusted flag, so a synthetic click from a malicious extension could trigger workflows such as unsubscribing from Gmail or editing Salesforce leads.
- Security & misuse
- Minor
Security researcher Ax Sharma of Manifold Security disclosed a flaw in Anthropic’s Claude for Chrome browser extension, reported by BleepingComputer. The extension executed a set of predefined AI workflows — including identifying and unsubscribing from Gmail promotional email, reading Google Docs comments, scheduling Google Calendar meetings, and modifying or converting Salesforce leads — without checking the browser’s Event.isTrusted property, which distinguishes clicks a real user made from ones generated synthetically by JavaScript.
Because the check was missing, a separate malicious browser extension already installed on a victim’s machine, with permission to modify content on the claude.ai domain, could fire synthetic clicks to trigger these workflows without the user’s knowledge. The attack was bounded rather than open-ended: it could only invoke Claude’s existing predefined actions, not arbitrary commands, and it depended on the victim having installed a malicious extension in the first place rather than working through prompt injection from a webpage alone.
Anthropic acknowledged the synthetic-click issue through its bug bounty programme and said it was already tracking it as a broader class of problem; a related finding involving an internal skipPermissions=true parameter was classified as informational rather than a vulnerability. Both issues reportedly remained exploitable in the extension’s then-current release, version 1.0.80. The disclosure was one of several in mid-2026 highlighting how browser-based AI agents, built to act on a user’s behalf inside logged-in sessions, expanded the attack surface around everyday productivity tools.