Claude for Chrome remains exposed to fake clicks two months after the warning, despite a one-line patch

By TechRadar · July 19, 2026.

The Claude for Chrome extension, in its version 1.0.80 released on July 7, 2026, carries two unpatched vulnerabilities according to a report by the security firm Manifold Security, which reported them to Anthropic on May 21 through its bug bounty program and received acknowledgment the following day. Two months and eight versions later, both flaws were still active in Manifold's tests on July 7.

The first is an origin-verification problem. Researcher Ax Sharma found that the extension never checked the browser's Event.isTrusted property—the indicator that distinguishes a real user click from one simulated by code—before executing nine predefined tasks: reading Gmail, opening Google Docs, checking Google Calendar or modifying Salesforce leads. Any other browser extension can simulate that click on claude.ai and trigger the action. The flaw received a CVSS score (the industry standard for measuring vulnerability severity, from 0 to 10) of 7.7, rated high, which rises to 9.6, critical, if the user has automatic execution enabled, because Claude then acts without asking for approval.

The second flaw is more structural: a side-panel URL parameter called skipPermissions activates a privileged mode that skips any consent prompt when set to "true". According to Manifold, only Anthropic's internal scheduled-task feature should build that kind of URL, but the panel obeys the parameter no matter where it comes from. One example cited in the report: Claude can read the Gmail inbox, identify promotional emails and automatically click their unsubscribe links. Manifold sums up the severity with a blunt sentence: "the bypass is still six lines of JavaScript."

What's striking is not just the existence of the flaws, but Anthropic's response. The company closed the first report claiming that an already-existing internal report covered the underlying problem, and classified the second as "informational," arguing that the parameter is only generated by its own system. Manifold counters with a concrete data point: the content-script code and the associated side panel tied to both flaws remained byte-for-byte identical across the eight versions released between 1.0.73 and 1.0.80. And according to Sharma, fixing the first flaw would have required a single additional line of code to validate isTrusted.

A technical detail reinforces the reading of the problem: both flaws reproduced identically whether Opus, Sonnet or Fable was selected as the side panel's model. This rules out that it's a problem with the language model itself—it's not that the AI "decides badly"—and confirms that it's a design flaw in the trust boundaries of the software wrapping the model: who can ask it to act and under what checks. The report itself connects the case with two categories of the OWASP reference framework for AI applications: LLM01 (prompt injection) and LLM06 (excessive agency, when a system acts with more autonomy than it should without human oversight).

This episode matters beyond one specific extension. It confirms something we have been pointing out for months at Zendoric: in agentic systems—where AI not only responds but acts on email, calendars or CRM—the weak link is usually not the model's intelligence, but the permissions scaffolding around it. An agent with the ability to read your Gmail or touch Salesforce is, by design, a new and more dangerous attack surface than a chatbot that only converses; the more autonomy it is granted (the automatic execution that pushes the CVSS to 9.6 is the perfect example), the less margin there is for basic verification errors. And as Manifold warns, detection is difficult precisely because network traffic and browser activity can look completely normal while the AI acts without real authorization.

Our read is that findings of this kind, more than anecdotal, are the price of entry in the agentic race: each lab is deploying assistants with growing permissions over email, documents and enterprise tools before the security discipline around those permissions matures at the same pace. In the short term, that means real vulnerabilities, corporate responses that sometimes minimize the risk rather than correct it, and an urgent need for external verification—independent audits, bug bounties taken seriously, not just announced—to become standard infrastructure, not an extra. In the long term, however, this friction is exactly the kind of learning we need to work through: reliable agentic AI, capable of truly managing our administrative tasks while we devote ourselves to what matters to us, will only arrive if design flaws like this one are detected and corrected now, while the technology is still manageable, and not when those agents already control critical infrastructure. The governance of these systems, not their conversational eloquence, is what will determine whether the promised abundance arrives with the safeguards in place.