Manifold Security disclosed two unpatched vulnerabilities in Claude for Chrome, Anthropic’s agentic browser extension, on 21 July. The core issue is a missing event.isTrusted check in Claude’s content script: a malicious browser extension can inject a DOM element, simulate a click on it, and Claude’s extension treats that synthetic click as if the user made it — no user interaction required. From there, the rogue extension can trigger any of Claude’s predefined actions, including reading Gmail, Google Docs, Calendar, Salesforce, Zillow or DoorDash, provided the browser permissions were already granted for normal use. Manifold first reported this in May 2026 against v1.0.72; Anthropic acknowledged it the next day, then closed both reports without fixing them. The flaw is still reproducible in v1.0.80, released 7 July.
This is a useful case study, not a reason to panic. It’s a browser-extension trust-boundary problem — one extension abusing another’s permissions — not a flaw in Claude’s model or its coding capability. But it’s the second time this exact class of bug has surfaced in Claude for Chrome (Manifold calls it “ClaudeBleed Reopened”), and it lands the same week Check Point flagged a fivefold rise in prompt-injection payloads across enterprise AI tools generally. The pattern is consistent: as agentic AI tools get more browser and file-system access, the attack surface isn’t the AI reasoning — it’s the plumbing around it, and vendors are visibly behind on patching it.
So what
If your team or your developers have Claude for Chrome installed, treat it the way you’d treat any browser extension with broad permissions: audit what else is installed in the same browser profile, and don’t assume “closed” in a vendor’s bug tracker means “fixed.” If you’re commissioning AI-assisted development work, ask your partner how they scope and isolate agentic tool permissions rather than just trusting the default install. That’s part of how we run AI-assisted development engagements — or get in touch if you want your current tool stack’s exposure reviewed.