A critical flaw has been discovered in Anthropic’s Claude Chrome browser extension, allowing malicious extensions to trigger AI actions by simulating user clicks. This vulnerability could potentially allow attackers to abuse Claude’s access to connected services such as Gmail, Google Docs, and Salesforce.
The issue was identified by Ax Sharma of Manifold Security, who found that the Claude extension did not verify whether click events originated from real users or were generated by JavaScript. Normally, browsers mark user-generated events as trusted by setting a specific property called Event.isTrusted to true. However, if an event is created programmatically using JavaScript, the browser automatically sets this property to false.
The Claude extension failed to check this property before executing predefined workflows, allowing malicious extensions with permission to run on the ‘claude.ai’ domain to inject synthetic click events and trigger AI actions. While this flaw does not enable arbitrary prompt injection, it does allow attackers to exploit one of nine predefined tasks built into the extension.
To carry out an attack, a malicious browser extension would need to be installed by a user, and it would then manipulate the webpage to trigger Claude’s workflows. This could potentially lead to sensitive actions being performed on connected services without the user’s explicit consent.
The impact of this flaw depends on how the Claude extension is configured, as well as whether users choose to approve sensitive actions or have Claude’s optional “Act without asking” setting enabled. With this feature turned on, predefined workflows can execute automatically, making it easier for attackers to exploit the vulnerability.
In a related finding, Manifold Security discovered an internal parameter called ‘skipPermissions=true’ that bypassed certain permission checks when launching the extension. However, they noted that this mechanism is not directly exploitable on its own and would require another vulnerability to create a specially crafted URL.
Both findings were reported to Anthropic through their bug bounty program, who acknowledged the reports and closed the synthetic-click report as a known issue. The second flaw was classified as informational. Notably, Manifold verified that both vulnerabilities remain exploitable in the latest version of the browser extension, 1.0.80, released on July 7.
To protect yourself from this vulnerability, it’s essential to be cautious when installing extensions and to regularly review your browser settings. Users should also ensure they are running the latest version of the Claude extension, as Anthropic has acknowledged the reports and may address the issue in future updates.
Source: Bleeping Computer — 2026-07-16