Claude’s AI assistant could be manipulated through browser extensions

TechRadar Published Jul 19, 2026 Reviewed Jul 19, 2026 ✓ Reviewed by citations.press editors

Manifold Security reported two unpatched vulnerabilities in Anthropic's Claude for Chrome browser extension version 1.0.80, released July 7, 2026, including a flaw allowing any browser extension to trigger nine predefined Claude workflows by simulating synthetic user clicks without verifying the Event.isTrusted property.

2 vulnerabilities · unpatched vulnerabilities in Claude for Chrome browser extension version 1.0.809 workflows · predefined Claude workflows that can be triggered via synthetic clicks7.7 CVSS score · first vulnerability under default settings9.6 CVSS score · first vulnerability when automatic execution is enabled Manifold Security, security researchers

Manifold Security confirmed on July 7, 2026, that both vulnerabilities remained exploitable in Claude for Chrome extension version 1.0.80, months after first reporting them to Anthropic on May 21, 2026.

2 vulnerabilities · exploitable vulnerabilities in Claude for Chrome extension version 1.0.802 months · time elapsed between initial disclosure and confirmation of unpatched status Manifold Security, security researchers

Anthropic released eight separate versions of the Claude Chrome extension between 1.0.73 and 1.0.80 without patching the specific handlers flagged by researchers, and Manifold Security verified the content-script and side-panel code remained byte-identical across those releases.

8 versions · Claude Chrome extension versions released between 1.0.73 and 1.0.80 Manifold Security, security researchers

Manifold Security demonstrated that the second vulnerability—enabled by the side-panel URL parameter `skipPermissions`—allows Claude to bypass permission prompts and perform privileged actions such as reading a user's Gmail inbox and automatically clicking unsubscribe links in promotional emails.

1 example task · privileged action enabled by `skipPermissions` bypass Manifold Security, security researchers

Manifold Security reported that the vulnerabilities affected Claude's Opus, Sonnet, and Fable side-panel model selections, indicating the issue lay in the extension's security design rather than the underlying AI models.

3 models · Claude side-panel models affected by vulnerabilities Manifold Security, security researchers

Security researchers at Manifold Security have claimed Anthropic's Claude for Chrome browser extension contains two unpatched vulnerabilities in version 1.0.80, released July 7, 2026.

According to Manifold Security, it first reported both vulnerabilities to Anthropic through the company's bug bounty program on May 21, 2026, and received acknowledgment the following day.

The first flaw lets any browser extension trigger nine predefined Claude workflows by simulating a synthetic user click on claude.ai.

Researcher Ax Sharma found that the extension never verified whether a click event carried the Event.isTrusted property before acting on it.

Under default settings, the vulnerability received a CVSS score of 7.7 High, increasing to 9.6 Critical when users enabled automatic execution because Claude could perform actions without approval.

The nine hardcoded tasks include reading Gmail, opening Google Docs, checking Google Calendar, and modifying Salesforce leads without asking.

Because the browser marks synthetic clicks as untrusted, the extension should have rejected them but instead executed the workflow anyway.

Manifold Security confirmed on July 7 2026 that both vulnerabilities still work against version 1.0.80, months after first reporting them to Anthropic.

Anthropic released eight separate versions between 1.0.73 and 1.0.80 without altering the specific handlers’ researchers had already flagged as vulnerable.

The company closed the synthetic-click report, saying an existing internal report already tracked the broader trust-boundary issue researchers had described in detail.

However, Sharma believes the fix required only one additional line of code to verify the click event's isTrusted property before allowing the workflow to continue.

A second flaw involves a side-panel URL parameter called skipPermissions, which can activate a privileged mode without any consent prompt.

When the parameter is set to true, the panel begins skipping permission checks entirely, allowing Claude to act without asking the user first.

Manifold notes that only Anthropic's own scheduled-task feature is supposed to construct this kind of privileged URL internally right now.

The panel, however, honours that parameter regardless of which script or page actually constructed the originating URL string in practice.

One example task lets Claude read a user's Gmail inbox, identify promotional messages, and automatically click the unsubscribe links inside them.

Manifold warns that "the bypass is still six lines of JavaScript," months after researchers first flagged the underlying issue to Anthropic.

Anthropic classified this second finding as informational, arguing that the parameter is only ever constructed by its own internal systems.

Manifold said the content-script and side-panel code linked to both vulnerabilities remained byte-identical across the eight subsequent extension releases examined after the original report.

The flaws were also reproduced across Claude's Opus, Sonnet, and Fable side-panel model selections, indicating that the issue affected the extension's security design rather than the underlying artificial intelligence models.

The report also connected the findings with OWASP concerns involving LLM01: Prompt Injection and LLM06: Excessive Agency risks in AI applications.

The researchers noted that abuse involving AI tools may remain difficult to detect because normal browser activity and network connections can appear unchanged while unauthorized AI actions occur.

Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds.

Efosa has been writing about technology for over 7 years, initially driven by curiosity but now fueled by a strong passion for the field. He holds both a Master's and a PhD in sciences, which provided him with a solid foundation in analytical thinking.

Please logout and then login again, you will then be prompted to enter your display name.

This article was originally published by TechRadar ↗. citations.press indexes the source-backed facts above and links to the original. Something wrong? Corrections policy · Report an error