- Anthropic Claude Extension Flaws Allow False Clicks to Launch Sensitive AI Workflows
- Researchers found vulnerable handlers unchanged in eight extension updates
- Synthetic clicks bypassed controls designed to confirm real user actions
Security researchers at Manifold Security have claimed that Anthropic’s Claude browser extension for Chrome contains two unpatched vulnerabilities in version 1.0.80, released on July 7, 2026.
According to Manifold Security, the company first reported the two vulnerabilities to Anthropic through the company’s bug bounty program on May 21, 2026, and received an acknowledgment the next day.
The first flaw allows any browser extension to trigger nine predefined Claude workflows by simulating a synthetic user click on claude.ai.
Nine workflows and a missing check
Researcher Ax Sharma discovered that the extension never checked whether a click event had the Event.isTrusted property before acting on it.
With default settings, the vulnerability received a high CVSS score of 7.7, increasing to a critical 9.6 when users enabled autorun, as Claude could perform actions without approval.
The nine hard-coded tasks include reading Gmail, opening Google Docs, checking Google Calendar, and editing Salesforce leads without asking.
Since the browser marks synthetic clicks as untrustworthy, the extension should have rejected them but performed the workflow anyway.
Manifold Security confirmed on July 7, 2026 that both vulnerabilities still work with version 1.0.80, months after first reporting them to Anthropic.
Anthropic released eight separate versions between 1.0.73 and 1.0.80 without changing specific handlers that researchers had already flagged as vulnerable.
The company closed the report on synthetic clicks, saying that an existing internal report already tracked in detail the broader issue of trust boundaries that the researchers had described.
However, Sharma believes the fix only required a single additional line of code to check the isTrusted property of the click event before allowing the workflow to continue.
A second structural weakness
A second flaw involves a side panel URL setting called skipPermissions, which can enable a privileged mode without any consent prompt.
When set to true, the panel begins to completely ignore permission checks, allowing Claude to act without first asking the user for permission.
Manifold notes that only Anthropic’s Scheduled Tasks feature is currently supposed to build this type of privileged URL internally.
The panel, however, respects this setting regardless of which script or page actually constructed the original URL string in practice.
A sample task allows Claude to read a user’s Gmail inbox, identify promotional messages, and automatically click the unsubscribe links they contain.
Manifold warns that “the workaround still involves six lines of JavaScript,” months after researchers first reported the underlying issue to Anthropic.
Anthropic classified this second discovery as informative, arguing that the setting is only constructed by its own internal systems.
Manifold said that the content script and side panel code related to the two vulnerabilities remained the same in bytes in the eight subsequent expansion versions examined after the original report.
The flaws were also reproduced in Claude’s Opus, Sonnet, and Fable side panel template selections, indicating that the issue affected the security design of the extension rather than the underlying AI models.
The report also relates the findings to OWASP’s concerns regarding LLM01: Rapid Injection and LLM06: Excessive Agency Risks in AI Applications.
The researchers noted that abuse involving AI tools may remain difficult to detect, as normal browser activity and network connections may appear unchanged while unauthorized AI actions occur.
Follow TechRadar on Google News And add us as your favorite source to get our news, reviews and expert opinions in your feeds.
