Unpatched Claude for Chrome Extension Flaws Enable Unauthorized Account Actions via Fake Clicks and Permission Bypass
Unpatched Claude for Chrome Extension Flaws Enable (TL-2026-1318), also tracked as ClaudeBleed follow-on, is a critical-severity software vulnerability scored CVSS 9.6, first published 2026-07-14. It has no confirmed attribution, affects Anthropic Claude for Chrome (browser extension), maps to 15 MITRE ATT&CK techniques (T1036, T1059.007, T1071.001), and is covered by 9 detection rules and 19 indicators of compromise.
Key facts for TL-2026-1318
- Threat ID
- TL-2026-1318
- Also known as
- ClaudeBleed follow-on, Claude for Chrome isTrusted/skipPermissions flaws
- Severity
- CRITICAL
- CVSS
- 9.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- 2026-07-14
- Last reviewed
- 2026-07-14
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- technology, all sectors using claude for chrome, enterprise knowledge workers
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 19
Malware and tooling in Unpatched Claude for Chrome Extension Flaws Enable
Malware and tooling: Claude for Chrome (agentic browser extension)
Manifold Security researchers reported two unpatched vulnerabilities in Anthropic's Claude for Chrome browser extension (through v1.0.80): a missing event.isTrusted validation in the content script's click handler that lets another extension forge a click and silently trigger hardcoded agentic prompts (Gmail, Google Docs, Calendar), and a ?skipPermissions=true URL parameter that grants the side panel a privileged, no-consent mode. Both remain reproducible eight releases after May 2026 disclosure, as of July 2026, and follow the earlier related 'ClaudeBleed' extension-trust flaw.
How Unpatched Claude for Chrome Extension Flaws Enable works
Anthropic's Claude for Chrome extension bridges the claude.ai LLM to a user's browser session via a privileged messaging interface (`externally_connectable` in the extension manifest) and a content script that listens for UI events to drive an agentic workflow. Manifold Security (led by Ax Sharma) identified and reported two distinct, unpatched weaknesses to Anthropic on May 21, 2026.
The first flaw is a click-validation bypass: the content script's onboarding/action click handler forwards matching UI events to Claude's side panel without checking the browser-native `event.isTrusted` property, which distinguishes genuine user-generated input events from script-dispatched synthetic ones. Because any other Chrome extension with script access to the claude.ai origin can dispatch a synthetic click event, an attacker-controlled extension can execute roughly six lines of JavaScript to simulate a click and silently trigger one of nine hardcoded prompts -- for example, reading and interacting with Gmail (including clicking unsubscribe links), opening and reading comments on the user's most recent Google Docs, or scanning and modifying Google Calendar entries. In Claude's default 'Ask before acting' mode a confirmation popup still appears, but when a user has enabled the extension's agentic 'Act without asking' mode, the forged click drives the action with no visible approval step -- the scenario the source article assigns a CVSS 9.6 (Critical) rating.
The second flaw is a URL-parameter-based privilege escalation: loading the extension's side panel with a `?skipPermissions=true` query parameter drops it into a privileged, no-consent execution mode without requiring any user gesture. Anthropic disputed the severity of this finding on the basis that presently only the extension itself constructs URLs containing this parameter, so no external actor can reach it directly. Manifold characterized it as a 'ticking time bomb': any future unrelated bug in the extension -- an XSS flaw, a new message handler, or a regression -- could let external code construct a `skipPermissions=true` URL and instantly obtain silent, full-account access.
Both issues were reported May 21, 2026. Anthropic acknowledged the reports within a day but disputed their severity, arguing the synthetic-click issue was already covered by existing internal documentation about the extension's threat model and that the URL parameter posed no external risk. Anthropic's internal tracking issue was marked 'Resolved' by June 9, 2026, without either fix shipping. Version 1.0.80, released July 7, 2026, still contained both flaws when Manifold re-verified, meaning the vulnerabilities persisted across eight point releases from initial disclosure.
These flaws follow a related, earlier disclosure by LayerX Security researcher Aviad Gispan, publicly documented as 'ClaudeBleed' (reported to Anthropic April 27, 2026; public disclosure May 8, 2026). ClaudeBleed exploited the same `externally_connectable` trust design flaw -- the extension validated the claude.ai *origin* of a message but not the *execution context* that actually sent it, letting any other installed extension (even one without special permissions) impersonate legitimate claude.ai script traffic and issue commands to the Claude agent. Anthropic's May 6, 2026 'partial' fix (v1.0.70) introduced an approval flow for privileged actions but did not address the root cause; Gispan demonstrated the fix could be bypassed by switching the agent into its 'privileged' mode without notifying the user. Researchers observed two bypass techniques recurring across both the ClaudeBleed and Manifold findings: 'Approval Looping' (programmatically forging repeated 'Yes, proceed' responses to satisfy confirmation prompts) and 'Perception Manipulation' (dynamically altering visible DOM/UI elements so the agent misreads a malicious action as benign). Manifold's Ax Sharma noted the core lesson is that 'monitoring AI agents at the prompt layer is fundamentally insufficient' when the agent's perceived environment itself can be manipulated to make malicious actions appear legitimate.
No CVE has been assigned to either the isTrusted click-validation bug or the skipPermissions privilege-escalation bug as of the July 14, 2026 reporting date. The flaws map to OWASP Top 10 for LLM Applications categories LLM01 (Prompt Injection) and LLM06 (Excessive Agency), reflecting the broader pattern of confused-deputy weaknesses in agentic browser extensions where an AI agent's privileged action surface can be reached and steered without genuine user authorization.
MITRE ATT&CK techniques used in TL-2026-1318
Defense Evasion
Execution
Command and Control
Collection
T1114.001 Local Email Collection; T1119 Automated Collection; T1185 Browser Session Hijacking; T1213 Data from Information Repositories; T1213.003 Code Repositories
Persistence
Initial Access
Lateral Movement
Privilege Escalation
T1548 Abuse Elevation Control Mechanism
Impact
Exfiltration
T1567.002 Exfiltration to Cloud Storage
defense-impairment
Affected products and versions in Unpatched Claude for Chrome Extension Flaws Enable
- Anthropic — Claude for Chrome (browser extension)
Vulnerable versions: 1.0.70; 1.0.71; 1.0.72; 1.0.73; 1.0.74; 1.0.75; 1.0.76; 1.0.77; 1.0.78; 1.0.79
Remediation for Unpatched Claude for Chrome Extension Flaws Enable
Patches
- No complete vendor patch confirmed as of 2026-07-14; v1.0.70 (2026-05-06) was a partial ClaudeBleed mitigation only; v1.0.80 (2026-07-07) still contains both Manifold-reported flaws
Immediate actions
- Disable Claude for Chrome's 'Act without asking' / agentic auto-approval mode; require explicit human confirmation for every privileged action
- Audit all installed Chrome extensions and remove any with unnecessary script/host permissions on claude.ai
- Restrict Claude for Chrome usage on accounts with access to sensitive Gmail, Google Drive, GitHub, or Calendar data until a validated fix ships
- Monitor extension messaging traffic to claude.ai origins for anomalous synthetic-event patterns
Workarounds
- Keep Claude for Chrome in default 'Ask before acting' mode (does not fully close the gap but preserves a visible approval popup)
- Uninstall or disable Claude for Chrome on browser profiles with other untrusted or unnecessary extensions installed
Longer-term hardening
- Validate event.isTrusted on all content-script click/UI handlers before forwarding to privileged agent actions
- Remove URL-parameter-based privilege escalation mechanisms (e.g. skipPermissions) entirely; gate privileged modes behind server-verified, non-URL state
- Redesign externally_connectable trust model to verify the actual execution context of a message, not merely its claimed origin
- Adopt environment-level integrity checks so the agent cannot be deceived by DOM/UI manipulation ('Perception Manipulation') into treating forged approvals as genuine
- Independent third-party security review of agentic browser extension privilege boundaries before each release
Weaknesses (CWE) in Unpatched Claude for Chrome Extension Flaws Enable
CWE-346, CWE-863, CWE-441
Timeline of Unpatched Claude for Chrome Extension Flaws Enable
- LayerX Security researcher Aviad Gispan reports the 'ClaudeBleed' extension-trust flaw (externally_connectable trusts origin, not execution context) to Anthropic.
- Anthropic responds that the report is a duplicate of an existing tracked issue.
- Anthropic ships v1.0.70 with an approval flow for privileged actions, described by Anthropic as an initial mitigation for ClaudeBleed; root cause remains unaddressed and the fix is later shown to be bypassable via 'privileged' mode switching.
- LayerX Security publicly discloses the ClaudeBleed vulnerability.
- Manifold Security reports two additional unpatched vulnerabilities to Anthropic: missing event.isTrusted validation on the content-script click handler, and a ?skipPermissions=true URL-parameter privilege-escalation path in the side panel.
- Anthropic's internal tracking issue for the Manifold-reported flaws is marked 'Resolved' without either fix having shipped.
- Anthropic releases Claude for Chrome v1.0.80; Manifold re-verifies both the isTrusted and skipPermissions flaws remain exploitable, unchanged across eight point releases since May.
- Cyber Security News and other outlets (SecurityWeek, CyberScoop, CSO Online) publish coverage of the unpatched, still-exploitable flaws; no CVE has been assigned.
Sources cited for Unpatched Claude for Chrome Extension Flaws Enable
- Claude for Chrome Vulnerability
- Unpatched Claude for Chrome Flaw Lets Extensions Read Gmail, Calendar
- Vulnerability in Claude Extension for Chrome Exposes AI Agent to Takeover
- Flaw in Claude's Chrome extension allowed 'any' other plugin to hijack victims' AI
- Claude in Chrome is taking orders from the wrong extensions
- Claude's Chrome Extension Vulnerability Allows Malicious Extensions to Steal Gmail and Drive Data
Threats related to Unpatched Claude for Chrome Extension Flaws Enable
Detection coverage for TL-2026-1318
As of 2026-07-14, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1318 across Splunk SPL, Microsoft KQL and Sigma, covering 19 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.