Executive Summary
Researchers have identified two significant security flaws in the Claude for Chrome browser extension (v1.0.80 and earlier) that remain unpatched. The primary vulnerability involves a bypass of trust checks where the extension fails to verify the 'isTrusted' property of click events. This allows any other extension with access to the 'claude.ai' domain to programmatically trigger nine hardcoded AI tasks, including reading a victim's Gmail, Google Docs, and Calendar without authentic user interaction.
Technically, the flaw stems from a content script that listens for clicks on elements matching '#claude-onboarding-button' and executes the associated task ID. While Anthropic introduced an allowlist of nine tasks to limit the impact of the original ClaudeBleed vulnerability, the lack of origin verification for click events effectively negates this protection. A second design weakness allows the side panel to enter a privileged 'skip_all_permission_checks' mode via a simple URL parameter, enabling silent execution if coupled with other delivery vectors.
This is a critical issue for organizations using agentic AI assistants. If a user has enabled the 'Act without asking' setting, an attacker-controlled extension can exfiltrate sensitive communication or modify third-party platform data like Salesforce leads entirely in the background. Despite reports to Anthropic in May 2026, the findings remain reproducible as of July 2026.