Security researchers have exposed two unpatched vulnerabilities in the Claude extension for Chrome, which could allow a malicious extension to execute simulated clicks and run sensitive tasks without direct user intervention. The problem becomes more serious when Claude is granted automatic task execution permissions, as the extension may handle emails, documents, and appointments without seeking new consent before each step.

Simulated Clicks Reach Emails and Documents

According to a report published on TechRadar, researchers from Manifold Security discovered that the Claude extension does not sufficiently verify that the click was performed by a real person. This allows a malicious extension to simulate a click and execute 9 pre-programmed tasks, including reading Gmail messages, opening Google Docs files, checking appointments in Google Calendar, and modifying customer data within Salesforce. The vulnerability has been rated as high-risk (7.7 out of 10) in normal settings, but it rises to 9.6 when automatic execution is enabled.

The Problem Persisted Through 8 Updates

The second vulnerability relates to a part within the link used to open Claude’s sidebar. It can be manipulated to bypass the consent request that appears before executing a task. The researchers said that bypassing this process requires only six lines of JavaScript code. They also found that the code segments responsible for the problem remained unchanged through eight consecutive updates. The team reported both vulnerabilities to Anthropic, but they persisted in the version tested by the researchers.