Security Flaw in Claude Chrome Extension Enables Rogue AI Actions
A security vulnerability in Anthropic's Claude for Chrome browser extension allows malicious extensions to secretly trigger predefined AI actions by simulating user clicks. Discovered by researchers at Manifold Security, the flaw lets attackers exploit Claude's connections to sensitive services like Gmail, Google Docs, Google Calendar, and Salesforce without the user's knowledge or consent.
The problem stems from how the Claude extension validates user intent before launching its built-in workflows. When a user or script clicks on a page element, the browser tags the event as trusted or untrusted using a property called Event.isTrusted. The Claude extension does not check this property, meaning it treats JavaScript-generated synthetic clicks the same as genuine human interactions and executes the corresponding AI task.
Manifold Security demonstrates that any malicious Chrome extension with permission to run on the claude.ai domain can inject a custom page element containing one of nine supported task identifiers and fire a fake click event. This tricks Claude into performing actions such as reading recent emails, modifying Salesforce leads, or creating calendar meetings, turning a helpful AI assistant into a powerful tool for data theft and unauthorized account manipulation.