ClaudeBleed: Rogue Extensions Can Silently Read Gmail via Claude for Chrome

Two months after Manifold Security first flagged the issue to Anthropic, Claude for Chrome remains exploitable in a way that lets any rogue browser extension silently drive Claude to read a victim’s Gmail, Google Docs, and Calendar data. The code path responsible is, according to the researchers, “byte-for-byte identical” across eight releases, up to and including v1.0.80 shipped on July 7, 2026. Anthropic has closed both vulnerability reports, one as an overlap with a pre-existing tracking ticket, the other as informational.

The Two Flaws

Manifold Security identified two distinct vulnerabilities in how Claude for Chrome handles trust and privilege.

The first is a missing event.isTrusted check. Claude’s content script listens for clicks on #claude-onboarding-button. When one of these clicks fires, the handler reads a data-task-id attribute from the element and loads the corresponding predefined workflow. The problem is that the handler never checks whether the click came from a real user or from a script. Browsers distinguish between the two by setting Event.isTrusted = true on genuine user-generated events and false on synthetic ones dispatched via JavaScript. Claude’s handler ignores this field entirely, which means any extension with DOM access to claude.ai can inject a button, assign it a task ID, dispatch a synthetic click, and have Claude accept it as a legitimate user action.

The attack sequence is direct. A malicious extension targets claude.ai, builds the button element with data-task-id="usecase-gmail", and dispatches the synthetic click. The handler fires, loads the Gmail-reading workflow, and Claude proceeds. With the “Act without asking” setting enabled, the entire sequence executes without prompting the user for confirmation.

The second flaw is a URL-based permission bypass. When the Claude side panel is opened with ?skipPermissions=true appended to its URL, the panel enters skip_all_permission_checks mode and begins executing immediately without requesting any user approval. Currently, only the extension itself can set this parameter, which limits immediate exploitation. The researchers treat it as a latent risk because any future URL-construction vulnerability in the extension, or in code that opens the panel’s URL, would turn this into a remote critical path.

What the Nine Workflows Expose

Claude for Chrome ships with nine predefined tasks. Three of them have been confirmed exploitable via the synthetic-click path in the current disclosure:

• usecase-gmail: reads email messages from the authenticated Gmail session
• usecase-gdocs: reads document content and comments from Google Docs
• usecase-calendar: reads calendar entries

The researchers also noted that Salesforce lead modification and similar integrations are in the task list, which extends the blast radius beyond Google services for enterprise users with those integrations configured.

The constraint is that exploitation requires a malicious extension to already be installed with permission to modify claude.ai’s DOM. This is a real requirement, not a trivial one, but the Chrome Web Store has a documented history of extensions that accumulate broad permissions under benign-sounding functions. A clipboard manager, a grammar checker, or a screenshot tool that requests access to all sites can satisfy this requirement.

Disclosure and Anthropic’s Response

Manifold reported both issues to Anthropic on May 21, 2026, against v1.0.72. Anthropic acknowledged receipt the following day. The company then closed the synthetic-click report as overlapping with an existing tracking ticket for a broader trust-boundary problem, the same underlying ClaudeBleed class of issue first raised earlier in 2026. The skipPermissions=true flaw was closed as informational.

No patch was shipped. The public disclosure on July 14, 2026 confirmed the findings still reproduce against v1.0.80.

Anthropic’s prior remediation for the original ClaudeBleed issue changed what could be requested through the allowlisted task IDs, but left the core problem intact: the extension never validates who is making the request. An earlier fix addressed the contents of the channel without addressing the channel’s authentication model.

Why the “Act Without Asking” Setting Matters

Claude for Chrome includes an optional mode called “Act without asking” that allows the extension to execute workflows without requesting explicit confirmation from the user. Anthropic ships this mode as opt-in precisely because of the risk of autonomous action. The mode exists to reduce friction for users who regularly use Claude’s predefined tasks and find the confirmation prompts disruptive.

When this setting is active, the synthetic-click exploit produces no visible user-facing prompt. The malicious extension triggers the workflow, Claude executes it, and the exfiltration completes without any chrome-level notification or extension UI being displayed. Disabling “Act without asking” introduces a confirmation step that the user would need to approve, which breaks the silent-execution path but does not fix the underlying vulnerability.

Defensive Guidance

For users, the direct mitigations are:

Disable “Act without asking” in Claude for Chrome settings if you have it enabled. This does not patch the vulnerability but breaks the silent-execution path, requiring a user confirmation step before any workflow fires.

Audit installed extensions for any that request permission to modify content on claude.ai or on all sites. Remove extensions you cannot verify. The Chrome Web Store review process has not historically been sufficient to block malicious extensions that acquire broad permissions gradually.

Consider removing Claude for Chrome until a patched version is released and confirmed by Manifold or another independent researcher.

For security teams managing enterprise Chrome deployments, the immediate action is to block or restrict chrome-extension:// access to claude.ai via your browser management policy if Claude for Chrome is not in active use. If it is in active use, disable the “Act without asking” mode organisation-wide through managed policy and restrict which other extensions are permitted to install alongside Claude.

There is no CVE assigned to either issue as of the public disclosure date. The version to watch for a patch is anything above v1.0.80. Manifold has indicated they will publish confirmation when a fix ships.