Claude Chrome Extension Flaw Let Other Browser Plugins Hijack AI Actions

Researchers at LayerX disclosed a critical flaw in Anthropic’s Claude Chrome extension that allowed any other Chrome extension, including ones with no declared permissions, to send hidden instructions to Claude and abuse its browser automation features. The issue reportedly stemmed from the extension trusting messages associated with the claude.ai origin without properly authenticating the true sender, creating a cross-extension privilege escalation path. In proof-of-concept attacks, LayerX said it used the weakness to extract files from Google Drive, read and send Gmail messages, steal code from connected private GitHub repositories, and even summarize or delete recent emails to conceal activity.

Anthropic said the bug had already been identified internally and released version 1.0.70 with mitigations, including approval flows for privileged actions, but LayerX reported that the fix was incomplete and that takeover remained possible through privileged mode and side-panel initialization paths. The researchers said the flaw exposed a broader trust-boundary problem in AI browser assistants, where interface-based approvals and safety guardrails can be bypassed if extensions fail to verify message origin and execution context. Separate White House discussions about tighter oversight of advanced AI models, including Anthropic systems with offensive cyber capabilities, underscored growing concern over how powerful AI tools are secured before deployment.