Researchers Find Two Unfixed Claude for Chrome Flaws Enabling Forged Tasks and Permission Bypass
Summary
Manifold Security says Claude for Chrome v1.0.80 still accepts synthetic clicks from extensions able to run on claude[.]ai, triggering allowlisted account tasks; a URL parameter can enable skip-permissions mode. No patch was available as of July 14.
Key points
- An extension able to run scripts on claude[.]ai can forge a click that triggers one of Claude for Chrome's allowlisted tasks.
- The click handler does not check event.isTrusted, so it accepts synthetic clicks as user input.
- Allowlisted tasks can access Gmail, the latest Google Doc and its comments, and Calendar. In the default mode, an approval prompt remains; “Act without asking” removes that prompt.
- Setting skipPermissions=true in the side-panel URL enables skip_all_permission_checks. The article says the URL can currently be built only by the extension, with no direct remote path.
- Manifold reported the issues against v1.0.72 in May and found the relevant code unchanged in v1.0.80 on July 7; The Hacker News also says its examination of the current build confirmed both mechanisms.
- Anthropic had not publicly responded to Manifold's findings, and no patch, CVE, or advisory was available as of July 14. Turning off “Act without asking” restores the approval step but does not fix the forged-click path.
- Manifold recommends rejecting synthetic clicks and not setting permission mode from the URL; the article reports these fixes had not shipped.
Article Details
- Vulnerability Types
- Synthetic-click trust validation failure
- Permission mode controlled by a URL parameter
- Severity
- Manifold Security rates the forged-click issue CVSS 7.7 High in default mode and 9.6 Critical with “Act without asking” enabled.
- Affected Versions
- Claude for Chrome v1.0.72
- Claude for Chrome v1.0.80
- Exploitation Status
- reported
- Exploit Availability
- unknown
- Patch Status
- unavailable
- Workarounds
- Turn off “Act without asking” to retain the approval step.
- Review extensions that can read or change data on claude.ai.
MITRE ATT&CK
T1059.007 · JavaScriptA script-capable extension can construct the expected page element, set an allowlisted task ID, and dispatch a synthetic click on claude.ai.T1114 · Email CollectionThe forged click can trigger the usecase-gmail task, which reads the user's mail.T1176 · Software ExtensionsThe described attack requires another rogue browser extension whose content script can reach claude.ai and trigger Claude for Chrome tasks.T1213 · Data from Information RepositoriesAllowlisted tasks can read the user's latest Google Doc and its comments, and access Calendar data.
Vendors
Products
CalendarClaude for Chrome still contains two unresolved issues that let a script-capable browser extension trigger allowlisted tasks for Gmail, Google Docs, and Calendar through a forged click on claude.ai.Claude for ChromeClaude for Chrome still contains two unresolved issues that let a script-capable browser extension trigger allowlisted tasks for Gmail, Google Docs, and Calendar through a forged click on claude.ai.GmailClaude for Chrome still contains two unresolved issues that let a script-capable browser extension trigger allowlisted tasks for Gmail, Google Docs, and Calendar through a forged click on claude.ai.Google DocsClaude for Chrome still contains two unresolved issues that let a script-capable browser extension trigger allowlisted tasks for Gmail, Google Docs, and Calendar through a forged click on claude.ai.