Security researchers say a malicious Chrome extension can make Claude for Chrome reach into your Gmail, Docs, and Calendar — and that the bypass is about six lines of JavaScript. Eight releases after the issue surfaced, Manifold Security reports it still reproduces.

The two flaws

The first is a synthetic click bypass. Claude for Chrome doesn’t verify whether a button click came from a human or from a script. A malicious extension can construct the elements it needs and fire synthetic clicks, and the approval flow treats scripted actions as genuine user consent. The whole point of a confirmation prompt is that a person saw it and agreed; if a script can press the button, the prompt is decoration.

The second is a URL parameter bypass — a ?skipPermissions=true parameter that skips repeated approval checks when Claude’s side panel starts. To the researchers’ credit, they say they found no direct external way to control it today, which makes this the lesser of the two.

The findings come from Manifold Security and remain reproducible as of version 1.0.80, dated 7 July 2026, according to TechRepublic. Their line is the one that stings: eight Claude for Chrome releases later, the bypass is still six lines of JavaScript.

What an attacker gets

A rogue extension can trigger Gmail access, Google Docs retrieval — comments included — and Google Calendar access. Anthropic had previously narrowed external callers to nine predefined tasks after an earlier disclosure known as ClaudeBleed, so this isn’t unbounded control. But “only nine tasks” is small comfort when the tasks include reading your mail.

The severity split is the real lesson

The two CVSS scores tell the story better than any prose: 7.7 (high) in default mode, where approval prompts still appear — and 9.6 (critical) when “Act without asking” is enabled.

Sit with that gap. The same flaw, in the same software, moves from serious to near-worst-case based purely on one convenience toggle. That’s the entire AI-agent security problem compressed into two numbers. Every agent product faces the same pressure: constant permission prompts are annoying, users disable them, and the setting that makes the product pleasant is the setting that removes the last thing standing between an attacker and your inbox.

And an unattended machine is the worst case by design. An agent that acts without asking, on a device nobody is watching, is an attacker’s dream — no human to notice the mouse moving.

What to do now

The practical advice is unglamorous and worth following: turn off “Act without asking,” audit which extensions have access to claude.ai, and limit which accounts are reachable by browser-based AI tools. That last one matters most — an agent can only reach what you’ve signed into. A browser profile with your entire life in it is a bigger blast radius than one with a single work account.

Anthropic didn’t provide immediate comment when asked, per the reporting.

The wider point

This isn’t really a story about one product. Browser agents are a genuinely new security surface: software that reads pages, clicks buttons, and holds your logged-in sessions, sitting in the most extension-riddled, hostile environment most people run. The old threat model asked whether an extension could steal your data directly. The new one asks whether it can convince something else that already has your data to hand it over.

The uncomfortable bit is the six lines. A confirmation dialogue that can’t distinguish a person from a script isn’t a security control — it’s a UI element. Any product that puts an agent in your browser has to answer that question properly, and “still reproducible eight releases later” is not the answer anyone wants.

Reporting on third-party security research as covered in July 2026; the vendor had not commented at publication. Verify current versions and mitigations before acting.