Claude for Chrome Flaw Lets Malicious Extensions Trigger AI Workflows
Summary
Manifold Security reports that Claude for Chrome 1.0.80 accepts synthetic clicks from a malicious extension, potentially triggering predefined workflows with access to connected services. Anthropic acknowledged the report; arbitrary prompt injection is not enabled.
Key points
- Manifold Security says the extension failed to check Event.isTrusted, allowing JavaScript-generated clicks to trigger built-in workflows.
- The attack requires a malicious extension permitted to modify content on claude[.]ai; it does not directly compromise the Claude extension.
- The workflows can access connected services including Gmail, Google Docs, Google Calendar, and Salesforce.
- The flaw is limited to nine predefined tasks and does not enable arbitrary prompt injection.
- Impact depends on extension configuration and whether users approve sensitive actions or enable the optional “Act without asking” setting.
- Manifold says the findings remain reproducible in version 1.0.80. Anthropic acknowledged the synthetic-click report; a separate skipPermissions finding was classified as informational.
Article Details
- Vulnerability Types
- Insufficient validation of synthetic click events
- Severity
- Unknown
- Affected Versions
- Claude for Chrome 1.0.80
- Exploitation Status
- reported
- Exploit Availability
- unknown
- Patch Status
- unknown
MITRE ATT&CK
T1059.007 · JavaScriptA malicious extension can inject JavaScript into claude.ai and generate synthetic click events to trigger Claude workflows.T1176 · Software ExtensionsThe described attack requires tricking a user into installing a malicious browser extension, which then manipulates the page and triggers Claude workflows.
People
Vendors
AnthropicA flaw in Anthropic’s Claude for Chrome extension could let a malicious browser extension trigger built-in AI workflows by faking user clicks, potentially abusing Claude’s access to connected services like Gmail, GoogleGoogleAI workflows by faking user clicks, potentially abusing Claude’s access to connected services like Gmail, Google Docs, Google Calendar, and Salesforce.Salesforcepotentially abusing Claude’s access to connected services like Gmail, Google Docs, Google Calendar, and Salesforce.
Products
Claude for ChromeA flaw in Anthropic’s Claude for Chrome extension could let a malicious browser extension trigger built-in AI workflows by faking user clicks, potentially abusing Claude’s access to connected services like Gmail, GoogleGmailAI workflows by faking user clicks, potentially abusing Claude’s access to connected services like Gmail, Google Docs, Google Calendar, and Salesforce.Google Calendaruser clicks, potentially abusing Claude’s access to connected services like Gmail, Google Docs, Google Calendar, and Salesforce.Google Docsworkflows by faking user clicks, potentially abusing Claude’s access to connected services like Gmail, Google Docs, Google Calendar, and Salesforce.Salesforcepotentially abusing Claude’s access to connected services like Gmail, Google Docs, Google Calendar, and Salesforce.