Another Day, Another Extension Flaw
If you use Claude for Chrome, there’s a fresh reason to check your installed extensions. Researchers have flagged a flaw that lets any rogue extension with script access to claude.ai quietly trigger tasks aimed at your Gmail, your latest Google Doc (including its comments), and your Calendar.
It’s not a remote hack. The attacker needs a foothold first — a malicious extension already running scripts on claude.ai. But once that’s in place, the door swings wide open.
What Exactly Is the Flaw?
The issue boils down to how Claude for Chrome handles task requests. A rogue extension can send a prompt to the extension’s backend, which then processes it against your connected Google services. The extension doesn’t need to ask you for permission each time — it just triggers the task, and the data flows back.
Researchers describe it as a scope problem. Back in May, Anthropic restricted the arbitrary-prompt path as part of its response to the earlier ClaudeBleed vulnerability. That fix closed off one route, but this new flaw exploits a different one — one that still allows task injection with the same end result: your emails, docs, and calendar events getting read without your explicit consent.
ClaudeBleed vs. This New Flaw
Both this and ClaudeBleed require a rogue extension that can already run a script on claude.ai. The difference is scope. ClaudeBleed was about arbitrary prompt injection; this one is about task-specific triggers. Think of it like this: ClaudeBleed was a master key, this is a lockpick for specific drawers.
What Data Is at Risk?
Here’s what a rogue extension could potentially access:
- Your Gmail inbox — reading email content, not just metadata
- Your most recent Google Doc, including the comment threads
- Your Google Calendar — events, times, attendees
That’s not a small slice of your digital life. For anyone using Claude for Chrome to handle work-related tasks, the exposure is serious.
What Has Anthropic Done?
Anthropic’s May response to ClaudeBleed was a step in the right direction — they restricted the arbitrary-prompt path. But this new flaw shows that restricting one path isn’t enough. The task-triggering mechanism remains a viable vector.
The company hasn’t yet released a full public patch for this specific issue at the time of writing. If you’re a heavy user, that’s worth paying attention to.
How to Protect Yourself Right Now
Until a fix lands, you can reduce your risk:
- Audit your extensions: Remove anything you don’t recognize or haven’t used in months. Check permissions carefully.
- Use a dedicated browser profile for Claude and other sensitive tools — don’t mix them with casual browsing extensions.
- Review connected apps: Go into your Google account settings and revoke access for anything that looks suspicious.
- Stay updated: Watch for Anthropic’s security advisories and update the extension as soon as patches drop.
This isn’t about paranoia — it’s about the reality of browser extension security. The ecosystem is built on trust, and every browser extension security issue like this erodes that trust a little more.
For now, the safe play is to treat Claude for Chrome like a tool that needs a clean room. Don’t let it share space with extensions you don’t fully vet.
