https://www.manifold.security/blog/claude-for-chrome-extension-bypass
Ax Sharma from Manifold Security has published fresh findings revealing that vulnerabilities in Anthropic’s Claude for Chrome extension, originally disclosed as part of the so-called ClaudeBleed research, remain exploitable in the latest available version despite Anthropic having marked the underlying tracking issue as resolved. He confirmed on 7 July that both findings, a synthetic click primitive and a URL-parameter initialisation issue in the extension’s side panel, are fully reproducible in version 1.0.80, with the content script and side-panel handlers found to be byte-identical to the version 1.0.72 originally tested. Anthropic released eight versions of the extension between the initial disclosure and the verification, yet none of the specific handlers cited in the report appear to have been modified.
The main concern centres on the extension’s permission model. When the side panel is opened via a crafted URL containing a privileged permission mode parameter, it boots directly into a state that bypasses normal permission checks. While Ax acknowledges this is not directly remotely exploitable in its current form, as constructing the side-panel URL still requires same-extension privilege, he warned the risk is structural rather than theoretical. Any future regression, new external message handler, or same-extension cross-site scripting vulnerability in the options or pairing pages could elevate this primitive to silent, privileged execution, potentially enabling a malicious browser extension to instruct Claude to silently read sensitive content such as Gmail without user awareness or consent.
The recommended remediation is that the extension should boot the side panel in ask mode unconditionally, require all permission-mode transitions to occur through explicit user-gesture clicks within the side-panel UI, and gate any legitimate scheduled-task requests for privileged mode on a sender-ID check via internal messaging.