--- title: New bugs in Claude for Chrome allow extensions to abuse... description: Two unpatched vulnerabilities in Anthropic's Claude for Chrome extension allow malicious browser extensions to abuse AI privileges. The first flaw involves the... canonical: https://daily.dev/posts/new-bugs-in-claude-for-chrome-allow-extensions-to-abuse-ai-privileges-1tfozhyjc twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: New bugs in Claude for Chrome allow extensions to abuse AI privileges | daily.dev og:description: Two unpatched vulnerabilities in Anthropic's Claude for Chrome extension allow malicious browser extensions to abuse AI privileges. The first flaw involves the... og:url: https://daily.dev/posts/new-bugs-in-claude-for-chrome-allow-extensions-to-abuse-ai-privileges-1tfozhyjc og:image: https://api.daily.dev/og/posts/1TFozhYjc.png og:image:alt: New bugs in Claude for Chrome allow extensions to abuse AI privileges og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # New bugs in Claude for Chrome allow extensions to abuse AI privileges **[CSO Online](https://daily.dev/sources/csoonline)** · 3 min read · 0 upvotes · 0 comments ## Summary Two unpatched vulnerabilities in Anthropic's Claude for Chrome extension allow malicious browser extensions to abuse AI privileges. The first flaw involves the click handler failing to verify event.isTrusted, enabling synthetic clicks that trick Claude into executing privileged actions like reading Gmail, Google Docs, and Calendar data. The second flaw involves a URL parameter (?skipPermissions=true) that puts the extension into a privileged mode, creating a latent risk for future exploits. Both bugs remain exploitable in version 1.0.80 despite being reported in May and Anthropic marking the tracking issue as 'resolved'. Manifold Security demonstrated the first exploit in six lines of JavaScript and proposed a one-line fix. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Is Claude for Chrome version 1.0.80 still vulnerable to the synthetic click exploit reported in May? Yes, the content script and side-panel handlers in version 1.0.80, released July 7, remain byte-identical to the originally tested v1.0.72, despite Anthropic marking the internal tracking issue for this vulnerability class as resolved. The flaw lets another browser extension generate synthetic clicks that Claude accepts as legitimate user approval for privileged actions. _Teams relying on Claude for Chrome can track unresolved AI security disclosures like this on daily.dev._ ### How can a malicious browser extension trick Claude for Chrome into performing privileged actions without real user approval? A malicious extension capable of injecting scripts into Claude.ai can fire synthetic clicks because Claude's click handler does not check the browser's event.isTrusted property before executing privileged actions. In default settings this can trigger a predefined browser task before an approval dialog appears; with 'Act without asking' enabled, Claude may execute the action silently, exposing Gmail, Google Docs, or Calendar data. Manifold demonstrated the exploit in six lines of JavaScript. _Developers assessing AI browser agent risk can follow exploit writeups like this on daily.dev._ ### What does the ?skipPermissions=true parameter do in Claude for Chrome's side panel? Loading Claude for Chrome's side panel with the ?skipPermissions=true URL parameter puts the extension into a privileged mode that bypasses repeated confirmation prompts. No direct external path to control this parameter was found, but tying privileged behavior to a URL value rather than verified user input creates a latent risk: any future bug influencing that parameter could inherit elevated privileges without additional checks. _Anyone auditing AI extension permission models can keep up with cases like this on daily.dev._ ## Similar posts on daily.dev - [Claude in Chrome is taking orders from the wrong extensions](https://daily.dev/posts/claude-in-chrome-is-taking-orders-from-the-wrong-extensions-fxzui5dan) · CSO Online · 1 upvotes · 0 comments - ['Claudy Day’ Trio of Flaws Exposes Claude Users to Data Theft](https://daily.dev/posts/claudy-day-trio-of-flaws-exposes-claude-users-to-data-theft-oxmixvsef) · Dark Reading · 8 upvotes · 0 comments - [Claude in Chrome is generally available](https://daily.dev/posts/claude-in-chrome-is-generally-available-kcapwjtof) · Claude · 21 upvotes · 5 comments --- Tags: [#devtools](https://daily.dev/tags/devtools), [#claude](https://daily.dev/tags/claude), [#anthropic](https://daily.dev/tags/anthropic), [#ai-security](https://daily.dev/tags/ai-security) [View this post on daily.dev](https://daily.dev/posts/new-bugs-in-claude-for-chrome-allow-extensions-to-abuse-ai-privileges-1tfozhyjc) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"New bugs in Claude for Chrome allow extensions to abuse AI privileges","url":"https://daily.dev/posts/new-bugs-in-claude-for-chrome-allow-extensions-to-abuse-ai-privileges-1tfozhyjc","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/new-bugs-in-claude-for-chrome-allow-extensions-to-abuse-ai-privileges-1tfozhyjc"},"datePublished":"2026-07-15T12:08:32.930Z","dateModified":"2026-09-14T06:50:49.854Z","description":"Two unpatched vulnerabilities in Anthropic's Claude for Chrome extension allow malicious browser extensions to abuse AI privileges. The first flaw involves the...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/fd64f8f664aab3fa68be9536b4bab56d?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/fd64f8f664aab3fa68be9536b4bab56d?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"CSO Online","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"CSO Online","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/98667e4b5cac46cf9c470819c6cf71cd","url":"https://daily.dev/sources/csoonline"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/new-bugs-in-claude-for-chrome-allow-extensions-to-abuse-ai-privileges-1tfozhyjc","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"devtools,claude,anthropic,ai-security","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"CSO Online","item":"https://daily.dev/sources/csoonline"},{"@type":"ListItem","position":3,"name":"New bugs in Claude for Chrome allow extensions to abuse AI privileges"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/new-bugs-in-claude-for-chrome-allow-extensions-to-abuse-ai-privileges-1tfozhyjc#faq","mainEntity":[{"@type":"Question","name":"Is Claude for Chrome version 1.0.80 still vulnerable to the synthetic click exploit reported in May?","acceptedAnswer":{"@type":"Answer","text":"Yes, the content script and side-panel handlers in version 1.0.80, released July 7, remain byte-identical to the originally tested v1.0.72, despite Anthropic marking the internal tracking issue for this vulnerability class as resolved. The flaw lets another browser extension generate synthetic clicks that Claude accepts as legitimate user approval for privileged actions. Teams relying on Claude for Chrome can track unresolved AI security disclosures like this on daily.dev."}},{"@type":"Question","name":"How can a malicious browser extension trick Claude for Chrome into performing privileged actions without real user approval?","acceptedAnswer":{"@type":"Answer","text":"A malicious extension capable of injecting scripts into Claude.ai can fire synthetic clicks because Claude's click handler does not check the browser's event.isTrusted property before executing privileged actions. In default settings this can trigger a predefined browser task before an approval dialog appears; with 'Act without asking' enabled, Claude may execute the action silently, exposing Gmail, Google Docs, or Calendar data. Manifold demonstrated the exploit in six lines of JavaScript. Developers assessing AI browser agent risk can follow exploit writeups like this on daily.dev."}},{"@type":"Question","name":"What does the ?skipPermissions=true parameter do in Claude for Chrome's side panel?","acceptedAnswer":{"@type":"Answer","text":"Loading Claude for Chrome's side panel with the ?skipPermissions=true URL parameter puts the extension into a privileged mode that bypasses repeated confirmation prompts. No direct external path to control this parameter was found, but tying privileged behavior to a URL value rather than verified user input creates a latent risk: any future bug influencing that parameter could inherit elevated privileges without additional checks. Anyone auditing AI extension permission models can keep up with cases like this on daily.dev."}}]} ```