Researchers Say Claude for Chrome Flaw Lets Rogue Extensions Trigger Gmail Reads

Manifold and other researchers found two related vulnerabilities in the Claude for Chrome extension that allow a malicious extension or script with DOM access to forge a click (no event.isTrusted check) and/or load a side-panel URL that disables permission prompts, enabling silent reads of Gmail, Docs, and Calendar and automated actions; the issues were reported in May and remain present in v1.0.80 as of July, with no CVE or public patch noted.