- Anthropic's Claude Extension Flaws Allow Fake Clicks to Launch Sensitive AI Workflows
- The researchers found that the vulnerable drivers did not change in eight extension updates.
- Synthetic clicks bypassed controls designed to confirm real user actions
Security researchers at Manifold Security have stated that Anthropic's Claude browser extension for Chrome contains two unpatched vulnerabilities in version 1.0.80, released on July 7, 2026.
According to Manifold Security, it first reported both vulnerabilities to Anthropic through the company's bug bounty program on May 21, 2026, and received acknowledgment the next day.
The first flaw allows any browser extension to trigger nine predefined Claude workflows by simulating a synthetic user click on claude.ai.
Nine workflows and one missing check
Researcher Ax Sharma discovered that the extension never checked whether a click event carried the Event.isTrusted property before acting on it.
Under the default configuration, the vulnerability received a CVSS score of 7.7 High, which increased to 9.6 Critical when users enabled autorun because Claude could perform actions without approval.
The nine coded tasks include reading Gmail, opening Google Docs, checking Google Calendar, and modifying Salesforce leads without asking.
Because the browser marks synthetic clicks as untrusted, the extension should have rejected them, but instead would have run the workflow anyway.
Manifold Security confirmed on July 7, 2026 that both vulnerabilities still work in version 1.0.80, months after first reporting them to Anthropic.
Anthropic released eight separate versions between 1.0.73 and 1.0.80 without altering specific drivers that researchers had already flagged as vulnerable.
The company shut down the synthetic click report, saying that an existing internal report already tracked the broader trust boundaries issue that researchers had described in detail.
However, Sharma believes the solution required only one additional line of code to check the isTrusted property of the click event before allowing the workflow to continue.
A second structural weakness
A second flaw involves a side panel URL parameter called skipPermissions, which can activate a privileged mode without any consent request.
When the parameter is set to true, the panel begins to skip permission checks entirely, allowing Claude to take action without first asking the user.
Manifold notes that only Anthropic's scheduled tasks feature is supposed to build this type of privileged URL internally at this time.
However, the panel respects that parameter regardless of which script or page actually built the source URL string in practice.
An example task allows Claude to read a user's Gmail inbox, identify promotional messages, and automatically click the unsubscribe links within them.
Manifold warns that “the bypass is still six lines of JavaScript,” months after researchers first flagged the problem underlying Anthropic.
Anthropic classified this second finding as informative, arguing that the parameter is only built by its own internal systems.
Manifold said the content script and side panel code linked to both vulnerabilities remained identical in bytes across the eight subsequent extension versions examined after the original report.
The flaws were also reproduced in Claude's Opus, Sonnet, and Fable side panel model selections, indicating that the issue affected the security design of the extension rather than the underlying AI models.
The report also related the findings to OWASP concerns related to LLM01: Rapid Injection and LLM06: Excessive Agency Risks in AI Applications.
The researchers noted that abuse involving AI tools may remain difficult to detect because normal browser activity and network connections may appear unchanged while unauthorized AI actions occur.
Follow TechRadar on Google News and add us as a preferred source to receive news, reviews and opinions from our experts in your feeds.
