Claude Chrome flaw still unfixed after eight updates

Anthropic’s Claude for Chrome extension still contains two unpatched vulnerabilities in version 1.0.80, released July 7, 2026, according to security researchers at Manifold Security. The firm says it first reported both issues through Anthropic’s bug bounty program on May 21, 2026, and received acknowledgment a day later.

The first flaw allows any browser extension to trigger nine predefined Claude workflows by simulating a fake user click on claude.ai. Researcher Ax Sharma said the extension failed to check the click event’s Event.isTrusted property before executing the action.

That matters because synthetic browser clicks are marked as untrusted and should be rejected. Manifold said the bug scores 7.7 High under default settings, rising to 9.6 Critical if users enable automatic execution, since Claude could then carry out actions without approval.

The affected hardcoded tasks include:

Recommended reading

23M Paidwork accounts reportedly exposed online

• reading Gmail
• opening Google Docs
• checking Google Calendar
• modifying Salesforce leads

Manifold said it verified on July 7, 2026 that both vulnerabilities still worked in 1.0.80, months after the original report. Anthropic shipped eight versions from 1.0.73 to 1.0.80 without changing the handlers the researchers had flagged. According to the report, Anthropic closed the synthetic-click finding because an existing internal report already tracked the broader trust-boundary issue.

A second weakness involves a side-panel URL parameter called skipPermissions. When set to true, it can enable a privileged mode that skips permission prompts entirely, allowing Claude to act without asking the user first. Manifold said Anthropic treats that parameter as safe because it is currently meant to be created only by the company’s own scheduled-task feature, but the side panel accepts it regardless of what script or page actually built the URL.

One cited example would let Claude read a user’s Gmail inbox, identify promotional emails, and click unsubscribe links automatically.

“The bypass is still six lines of JavaScript.”

Anthropic classified the second issue as informational, Manifold said. The researchers added that the relevant content-script and side-panel code remained byte-identical across the eight later releases they examined. They also reproduced the flaws across Opus, Sonnet, and Fable model options, suggesting the problem lies in the extension’s security design rather than the models themselves.

The report links the findings to OWASP concerns around LLM01: Prompt Injection and LLM06: Excessive Agency, and warns that this kind of abuse may be hard to spot because normal browser activity and network traffic can look unchanged while unauthorized AI actions take place.