Researcher finds Claude for Chrome extension flaw letting malicious sites trigger AI actions
The extension did not check the browser's isTrusted flag, so a synthetic click from a malicious extension could trigger workflows such as unsubscribing from Gmail or editing Salesforce leads.
Security & misuse