Overview
- Independent researchers reviewed Claude for Chrome v1.0.80 in mid‑July and found two persistent vulnerabilities that Manifold reported to Anthropic on May 21.
- The main flaw is a click handler that does not check the browser’s event.isTrusted flag so script‑dispatched (synthetic) clicks are treated as real user taps and can start allowlisted tasks.
- A separate design gap reads a skipPermissions=true URL parameter when the side panel opens and boots the extension into a no‑permission mode that removes approval prompts.
- Exploitation requires another extension or a page script that can run on claude.ai, and severity jumps from high (CVSS ~7.7) to critical (CVSS ~9.6) if a user has enabled the extension’s autonomous ‘Act without asking’ mode.
- Anthropic acknowledged earlier reports and shipped an allowlist that limits which tasks can run but had not published a CVE, advisory, or a patch to block synthetic clicks or the URL permission control as of July 14–15, so users should disable autonomous mode and review extensions that can run on claude.ai.