Claude Chrome extension flaw lets malicious extensions trigger AI actions

1. Executive summary

A flaw in Anthropic's Claude for Chrome browser extension allows a malicious extension co-installed in the same browser to trigger nine predefined AI workflows by injecting synthetic click events that the extension failed to validate against the browser's Event.isTrusted property. The workflows can abuse Claude's authenticated access to connected services including Gmail, Google Docs, Google Calendar, and Salesforce — executing actions such as reading email, modifying Salesforce leads, and creating calendar meetings. No CISA-KEV exploitation data, CVSS score, or CVE identifier has been resolved for this item. The vulnerability requires a user to have already installed a malicious extension with content-script permissions on the claude.ai domain; it does not permit arbitrary prompt injection or direct compromise from a website. For EMEA financial services, the risk is concentrated in environments where staff use Claude's browser extension with OAuth-granted access to SaaS platforms holding sensitive customer or deal-pipeline data.

2. Regulatory framing

No specific DORA/NIS2 article is directly engaged by this item. The flaw requires a pre-existing malicious extension on an endpoint — it is a client-side browser-extension interaction issue, not an ICT third-party provider service failure or a supply-chain compromise of a vendor product. General ICT incident management and testing obligations under DORA Arts. 17–18 and 24 apply as they would to any security weakness, but no article's specific trigger is distinctive to this item.

3. Technical analysis & attack chain

Verified reference data: None resolved. No CVE, CVSS, CISA-KEV status, or MITRE actor profile is available. All technical detail below is single-sourced to the BleepingComputer report and the underlying Manifold Security research it describes.

Attack chain (confirmed steps from source)

1. Precondition — malicious extension installed. The victim has the Claude for Chrome extension installed and has granted it authenticated access to one or more connected services (Gmail, Google Docs, Google Calendar, Salesforce). A second, malicious extension is also installed in the same browser profile and holds content-script permissions on the claude.ai domain. The source explicitly notes this is a prerequisite — a website alone cannot compromise the extension directly.
2. DOM injection. The malicious extension injects JavaScript into the claude.ai page. Chrome extensions with content-script permissions can read and modify page DOM, including creating new page elements.
3. Workflow trigger element creation. The injected script creates a page element containing one of nine supported task identifiers. The four named identifiers are: - usecase-gmail — read recent Gmail, identify promotional emails, click unsubscribe links - usecase-gdocs — open the user's latest Google Doc, read all comments and feedback - usecase-calendar — read Google Calendar, find free slots, create meetings - usecase-salesforce — modify Salesforce leads, convert them to opportunities
4. Synthetic click event generation. The malicious script programmatically generates a click event targeting the injected element. The browser correctly sets Event.isTrusted to false on this synthetic event.
5. Flawed event handling. The Claude extension's event listener fires on the click event but does not check Event.isTrusted. It treats the untrusted synthetic click as a legitimate user interaction and executes the corresponding predefined AI workflow.
6. Action execution against connected services. Claude executes the workflow using its existing authenticated sessions with the connected SaaS platforms. If the user has enabled Claude's "Act without asking" setting, the workflow executes automatically with no additional user approval prompt. If not, the user would see a confirmation prompt — but the source does not confirm whether the synthetic click could also dismiss such a prompt.

Scope and limitations

• The attack is limited to the nine predefined task identifiers built into the extension. It does not allow arbitrary prompt injection or free-form instruction of the Claude model.
• The malicious extension already has broad DOM access to pages in its scope; the incremental risk is that this flaw bridges that access to Claude's authenticated OAuth sessions with third-party SaaS platforms — sessions the malicious extension would not otherwise hold.

Secondary finding — skipPermissions=true parameter

Researchers identified an internal skipPermissions=true parameter that bypassed certain permission checks when launching the extension. They acknowledged this was not directly exploitable on its own and would require another vulnerability to deliver a specially crafted URL. Treat as low-confidence secondary detail.

Attribution: No threat actor is named. No exploitation in the wild is reported. This is a responsible-disclosure vulnerability report, not an observed campaign.

4. Mitigation & containment

P1 — Within 24 hours

• Audit extension deployments. Inventory all endpoints for the Claude for Chrome extension. Determine which users have it installed and which connected services (Gmail, Google Docs, Calendar, Salesforce) are authorised.
• Disable "Act without asking." For any users who must retain the extension, ensure the "Act without asking" setting is disabled so that workflow execution requires an interactive user approval. This is the single most impactful configuration control available pending a vendor fix.
• Restrict malicious extension surface. Review Chrome extension allow-lists in your endpoint management platform (e.g., Chrome Enterprise policies ExtensionInstallAllowlist / ExtensionInstallBlocklist). Block any unapproved extensions with broad host permissions. The attack requires a second malicious extension with claude.ai content-script access — extension allow-listing is the primary preventive control.

P2 — Within 72 hours

• Assess SaaS OAuth exposure. Review which Claude-connected accounts hold sensitive data. For Salesforce in particular, assess whether lead/opportunity modification via the extension creates audit-trail or data-integrity risks in your CRM. Revoke Claude's OAuth grants for any connected service where the business case does not require it.
• EDR / DLP coverage for browser extension behaviour. Where endpoint tooling supports it, alert on extensions requesting claude.ai host permissions that are not on the approved list.

P3 — Within 7 days

• Monitor for vendor fix. Anthropic acknowledged the report and closed the synthetic-click issue, stating they were already tracking it as a broader issue. No patched version number or fix timeline is identified in the source. Monitor Anthropic's security advisories and extension update channel.
• Policy decision on retention. For regulated roles (trading, client-facing, CRM data stewards), evaluate whether the Claude extension should be permitted at all until a fix is confirmed. The combination of authenticated SaaS access and synthetic-event triggering presents a data-integrity and confidentiality risk that may exceed the tool's operational benefit for those roles.

5. Indicators of compromise

No indicators of compromise available in the source material. This is a vulnerability advisory, not an observed intrusion. No file hashes, domains, IPs, or command-line artefacts are described.

Behavioural indicators

6. Detection

Insufficient indicators to author detection rules. The source describes a DOM-level event-handling flaw and workflow identifiers that are legitimate extension internals — not threat artefacts suitable for YARA or Sigma rules. The four usecase-* strings are part of the Claude extension's normal operation and would generate false positives if matched. No malicious file, command line, registry key, or network indicator is described.

7. Sources

• BleepingComputer, "Claude Chrome extension flaw lets malicious extensions trigger AI actions," https://www.bleepingcomputer.com/news/security/claude-chrome-extension-flaw-lets-malicious-extensions-trigger-ai-actions/, 2026-07-16
• Underlying research: Manifold Security / Ax Sharma (referenced in the BleepingComputer report; no direct URL to the Manifold report was provided in the source material)

8. Adverse Trace position

This is a real but bounded vulnerability. The attack requires a pre-existing malicious extension with claude.ai content-script permissions — it is not remotely exploitable from a website and does not permit arbitrary prompt injection. The incremental risk is that the flaw bridges a malicious extension's DOM access to Claude's authenticated OAuth sessions with SaaS platforms, potentially enabling silent email reading, calendar manipulation, and Salesforce lead modification. For EMEA financial services, the exposure is material where staff use Claude's extension against Salesforce or Gmail holding customer data, particularly if "Act without asking" is enabled. No CVE, CVSS, CISA-KEV entry, or patched version has been resolved — all technical detail is single-sourced to the BleepingComputer report citing Manifold Security; verify against the primary Manifold report before enforcement. Our immediate recommendation is to disable "Act without asking," enforce extension allow-listing, and reassess whether the extension should be permitted on regulated endpoints until Anthropic confirms a fix. We will monitor for a CVE assignment, vendor patch, and any evidence of in-the-wild exploitation.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.