TLDR Tech / InfoSec
Unpatched Claude for Chrome Flaw Lets Extensions Read Gmail and Calendar
Security firm Manifold identified two flaws that could allow a malicious browser extension to take actions on a user's behalf when using the Claude in Chrome browser extension. The core issue stems from the ClaudeBleed mitigation, which restricted the extension to a set of pre-approved tasks. The researchers found that the mechanism that triggers the tasks doesn't verify whether a triggering click came from a user or an extension. The researchers also uncovered a flaw they were unable to exploit that could allow the extension to auto-launch in 'Act without asking' mode.
Read the full story