- Anthropic’s Claude extension flaw allows fake clicks to launch sensitive AI workflows
- Researchers found vulnerable handlers unchanged across eight extension updates
- Synthetic clicks bypassed controls designed to confirm real user actions
Security researchers at Manifold Security have claimed that Anthropic’s Claude for Chrome browser extension contains two unpatched vulnerabilities in version 1.0.80, released on July 7, 2026.
According to Manifold Security, it first reported both vulnerabilities to Anthropic through the company’s bug bounty program on May 21, 2026, and received a confirmation the following day.
The first flaw allows any browser extension to trigger nine predefined Claude workflows by simulating a synthetic user click on claude.ai.
Nine workflows and one lack of control
Researcher Ax Sharma found that the extension never confirmed whether a click event carried the Event.isTrusted property before acting on it.
Under default settings, the vulnerability received a CVSS score of 7.7 High, increasing to 9.6 Critical when users enabled auto-execution because Claude could perform actions without authentication.
The nine hard-coded tasks include reading Gmail, opening Google Docs, checking Google Calendar, and changing Salesforce topics without asking.
Because the browser marks synthetic clicks as untrusted, the extension should have rejected them, but instead performed the workflow anyway.
Manifold Security confirmed on July 7, 2026 that both vulnerabilities still work against version 1.0.80, months after first reporting to Anthropic.
Anthropic released eight separate versions between 1.0.73 and 1.0.80 without changing the specific handlers researchers had already flagged as vulnerable.
The company shut down the synthetic-click report, saying an existing internal report already tracked the broader trust-limit issue that researchers had detailed.
However, Sharma believes that the fix only required one extra line of code to verify the click event’s isTrusted property before allowing the workflow to continue.
Another, structural weakness
Another bug involves a sidebar URL parameter called skipPermissions, which can enable privileged mode without any kind of consent prompt.
When the parameter is set to true, the panel starts skipping permission checks entirely, allowing Claude to act without asking the user first.
Manifold notes that only Anthropic’s own scheduled tasks function is supposed to construct this kind of privileged URL internally right now.
However, the panel respects this parameter regardless of which script or page actually constructed the original URL string in practice.
An example task lets Claude read a user’s Gmail inbox, identify promotional messages, and automatically click unsubscribe links in them.
Manifold warns that “the bypass is still six lines of JavaScript,” months after researchers first reported the underlying problem to Anthropic.
Anthropic classified this second finding as informative, claiming that the parameter is only constructed by its own internal systems.
Manifold said the content script and sidebar code associated with both vulnerabilities remained byte-identical across the eight subsequent extension releases examined after the original report.
The errors were also reproduced across Claude’s Opus, Sonnet, and Fable sidebar model selections, indicating that the issue affected the extension’s security design rather than the underlying AI models.
The report also links the findings to OWASP concerns involving LLM01: Prompt Injection and LLM06: Excessive Agency risks in AI applications.
The researchers noted that abuse involving AI tools can remain difficult to detect because normal browsing activity and network connections can appear unchanged while unauthorized AI actions occur.
Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews and opinions in your feeds.
