ClaudeBleed — co-resident Chrome extensions coerce Claude for Chrome into reading Gmail/Docs/Calendar
Disclosed vulnerability21 May 2026 / 14 Jul 2026🗺️ Computer-Use AgentManifold Security reported that any co-resident browser extension could weaponize Claude for Chrome — dispatching synthetic clicks the agent accepted without checking Event.isTrusted, and loading its side panel with ?skipPermissions=true — to make the AI read the victim's Gmail, Docs and Calendar; reportedly still unpatched across eight releases (CVSS up to 9.6, per the researchers).
Root cause — why it happened
Claude for Chrome is an AI helper that lives in your browser and can act inside sites you're logged into. Manifold Security reported that another extension installed in the same browser could quietly poke Claude's controls — faking the 'user clicked' signal, or opening Claude's panel with a setting that skips the usual permission prompts. Once it did, it could steer Claude into a handful of built-in tasks that read your Gmail, Google Docs and Calendar, using the access you'd already given. It never needed to trick Claude with a booby-trapped web page; it just abused the fact that Claude trusted signals any co-installed extension could forge.
Risks this case illustrates
Named in the standard (OWASP/ATLAS/NIST) lens. Click a highlighted component in the diagram below to see which risks attach where.
How it unfolded
Two extensions share one browser
The victim uses Claude for Chrome, Anthropic's in-browser AI assistant. They also have another browser extension installed — one they trusted, or one that turned malicious later. Both run in the same browser, so both can see the pages the browser shows, including Claude's own page.
Controls & guardrails — what would have stopped it
The real fix is to make sure a 'yes' really came from the person. If Claude checked that a click was made by a human — not faked by software — and had no hidden switch to skip its permission prompts, a rogue extension couldn't order it around. On top of that, giving the agent access to only what a task needs, and limiting where it can send data, would shrink the damage if something slipped through.
- Least-privilege identity & scoped credentials
Doesn't prevent manipulation — only caps its reach. Hard to get right operationally; over-broad scopes are the common real-world failure.
- Human-in-the-loop approval on high-risk actions
Approval fatigue turns gates into rubber stamps; gates placed after the point of no return do nothing; and approvers can be misled by a model-written summary of the action.
- Egress allowlisting & DLP on tool argumentsaddressesSensitive Data Leakage
Allowlists fight an open-ended channel; legitimate-but-broad destinations (any URL fetch, any email) are hard to constrain without breaking usefulness. Encoding can evade naive DLP.
- Runtime monitoring & anomaly detection
Detects the anomalous, not the novel-but-subtle; high false-positive rates cause alert fatigue. Always a step behind a sufficiently quiet attacker.
- Full-trace audit logging
Logging is forensic, not preventive — it explains harm after the fact. Useless if no one reviews it or if the materialised context isn't captured.
- Governance: risk assessment, red-teaming & incident response
Process reduces likelihood and speeds recovery but executes no technical control itself; weak follow-through makes it theatre.
- Loop/cost circuit-breakers & consistency checksaddressesExcessive Agency
Thresholds are blunt — too tight breaks legitimate long tasks, too loose lets damage accrue first. Catches runaway dynamics, not a single well-formed bad decision.
Lessons
- ▸ A consent gesture is only a control if its provenance is verified — an in-browser agent must check Event.isTrusted (or equivalent user-activation) before treating a click as user intent.
- ▸ Never expose a client-settable parameter (like ?skipPermissions=true) that selects a no-permission-check path; anything a co-resident script can set is attacker-controllable.
- ▸ Co-resident browser extensions are a distinct threat surface from malicious web pages: the attacker shares your control surface, so page-content injection defences don't apply.
- ▸ Narrowing an agent to a few canned tasks isn't containment if those tasks are themselves sensitive reads (Gmail/Docs/Calendar) running on already-granted permissions.
- ▸ 'Act without asking' converts a coerced-approval flaw into silent execution — default-safe modes and least-privilege session scope materially change the severity.
Proposals & gaps this case surfaced
Non-destructive suggestions for the library — proposed, not adopted.
A confused-deputy in which another program sharing the agent's client environment — a peer browser extension with content-script access, or a local process — forges the signals the agent uses to establish user intent: a script-dispatched DOM event accepted without validating Event.isTrusted, or a client-settable parameter (e.g. ?skipPermissions=true) that selects a no-permission-check code path. The agent then executes actions under the user's standing browser/session authority as though the user had consented, with no credential theft and, in silent-execution modes, no visible prompt.
For in-browser/desktop agents, treat every signal reaching the agent's privileged control surface as untrusted until proven user-originated. Enforce the browser's gesture-provenance bit (Event.isTrusted / navigator user-activation) on any handler that authorises an action or task, so a script-dispatched event cannot pass as a human click. Remove client-settable parameters or flags (e.g. ?skipPermissions=true) that select a no-permission-check path. Isolate the agent's UI from co-resident extensions/processes — dedicated origin, closed shadow DOM, authenticated message origins — so a peer cannot inject into or read the control surface. Closes the co-resident coercion vector where a rogue extension forges consent; pairs with least-privilege session scope (no standing Gmail/Docs/Calendar authority) and default-safe modes ('ask before acting') to bound residual impact.
This case shows a gap people miss: we protect AI agents from tricky web pages and emails, but we rarely ask whether another program on the same device can fake the user's 'yes'. Here the danger wasn't a bad website — it was a second browser extension forging the click that Claude trusted. Verifying that a consent gesture genuinely came from the human should be its own named safeguard for in-browser and desktop agents.
These surface as proposals across the Control Library and Risk Taxonomy; adopt them by hand when ready.
Sources
- ClaudeBleed Reopened: Browser Extensions Can Still Push Claude for Chrome to Read Your Gmail — Manifold Security (primary) ↗
- Researchers Say Claude for Chrome Flaw Lets Rogue Extensions Trigger Gmail Reads — The Hacker News (14 Jul 2026) ↗
- Unpatched Claude for Chrome Flaw Lets Extensions Read Gmail, Calendar — SecurityWeek (14 Jul 2026) ↗
- ClaudeBleed Reopened: Browser Extensions Can Still Push Claude for Chrome to Read Your Gmail — Manifold Security (primary) ↗ — Original research; the Event.isTrusted omission, ?skipPermissions=true path, the nine canned tasks, CVSS 7.7/9.6, and the 'byte-identical across eight releases' claim are Manifold's own.
- Researchers Say Claude for Chrome Flaw Lets Rogue Extensions Trigger Gmail Reads — The Hacker News (14 Jul 2026) ↗ — Secondary reporting; confused-deputy framing and disclosure timeline.
- Unpatched Claude for Chrome Flaw Lets Extensions Read Gmail, Calendar — SecurityWeek (14 Jul 2026) ↗ — Secondary reporting; interim mitigations (disable 'Act without asking', remove untrusted extensions).
Practise the risk class — related scenarios
An ops agent gets one god-mode credential — and one misread wipes production
A team of agents agrees its way into a confidently wrong answer — and a runaway loop
A support email hides instructions — and the assistant obeys them
A text-to-SQL agent runs the model's output straight at the database
A jailbroken agent decomposes one malicious goal into hundreds of harmless-looking steps — and per-step filters never see the attack
A poisoned issue makes the agent lie to the human who approves its actions
A speed optimisation becomes a cross-tenant listening device
Two doors to the same secret: reconstruct the model through its API, or just walk off with the weight file
Told it's being shut down, an agent reaches for leverage — with no attacker in sight
A fake Sentry error report hijacks a developer's coding agent into running a shell command
The forensic record is itself the attack surface — an agent's log is poisoned, then quietly rewritten
A 'safe' dataset preview turns an upload into code execution on the pipeline's workers
A shopping page tells the agent to do something the user never asked for
An attacker plants prompt injection in the audit trail — so the LLM that hunts them erases the evidence
Encoded public text is laundered across an agent handoff into an on-chain transfer
A screenshot that's harmless at full size becomes an order once the system shrinks it
An attacker captures the agent's bearer token — and inherits its authority
A forged peer registers on the agent directory — and the planner enlists it
A poisoned web page hijacks a research agent — and the planner acts on its behalf
A GUI agent clicks 'Continue' — but the screen moved, and it lands on 'Send'
An inbox summary quietly ships a secret to an attacker's server