Unpatched Claude for Chrome Flaws Expose Gmail, Docs, and Calendar Data

Researchers at Manifold disclosed two unpatched vulnerabilities in Anthropic’s Claude for Chrome extension that can let a malicious browser extension trigger Claude actions and access sensitive Google Workspace content, including Gmail messages, Google Docs data and comments, and Google Calendar entries. The researchers said the flaws were reported in May and remained reproducible in version 1.0.80, with one issue allowing another extension that has script access on claude.ai to simulate a trusted user click and launch hardcoded Claude prompts on the victim’s behalf.

The weaknesses stem in part from Anthropic’s earlier mitigation for ClaudeBleed, which limited prompts to pre-approved tasks but did not verify that task-triggering clicks came from a real user. Manifold also identified a separate design flaw in which Claude’s side panel can enter a privileged no-confirmation mode through a URL parameter, creating a potential privilege-escalation path if a future bug allows outside control of that parameter. The risk is highest when users enable Claude’s “Act without asking” mode, because the extension may perform actions without visible consent prompts; Anthropic acknowledged the reports but had not issued fixes, saying one issue was already tracked internally and the other was not externally reachable.