Researchers Say Claude for Chrome Flaw Lets Rogue Extensions Trigger Gmail Reads

Researchers have identified a vulnerability in the Claude for Chrome browser extension that allows rogue extensions to trigger unauthorized actions, such as reading Gmail, Google Docs, and Calendar data, by exploiting forged script-generated clicks. The flaw stems from the extension's failure to validate the authenticity of user interactions (event.isTrusted), enabling malicious extensions to simulate clicks and initiate sensitive tasks. If users have enabled 'Act without asking' mode, these actions execute silently without approval, increasing the risk to critical levels. The issue remains unpatched as of version 1.0.80, despite being reported to Anthropic in May 2026.

AI-extracted · verify before operational use