Claude for Chrome Cross-Extension Privilege Escalation (Rogue Extension Gmail/Calendar/Docs Access)
First seen Jul 15, 2026 · Updated Jul 15, 2026
Security researchers found that Claude for Chrome, Anthropic's browser-based AI agent, can be manipulated by any other malicious browser extension capable of injecting a script into claude.ai. This allows a rogue extension to trigger Claude's authenticated agent actions, silently reading a victim's Gmail, Google Docs (including comments), and Calendar without direct user consent for that specific action. The flaw is related to but distinct from the previously disclosed 'ClaudeBleed' issue, sharing the same rogue-extension prerequisite but differing in the scope of accessible data.
Technical Analysis
The vulnerability arises because Claude for Chrome executes agentic tasks within the browser context using the user's authenticated sessions to Gmail, Google Docs, and Google Calendar, and does not sufficiently isolate its command/prompt interface from other extensions sharing the same origin (claude.ai). A malicious or compromised extension with content-script injection capability on claude.ai can craft inputs that cause Claude's agent to execute unauthorized read actions against connected Google services, effectively using the AI agent as a confused deputy to exfiltrate sensitive data. Anthropic partially mitigated a related arbitrary-prompt injection vector in May, but this narrower flaw persists because the extension-to-agent trust boundary is still not fully enforced. No CVE has been assigned as of this report, and exploitation requires an existing rogue extension already installed in the victim's browser, making this a chained/secondary-stage risk rather than a standalone initial-access vector. This is a direct agent-relevant threat: organizations deploying browser-based AI agents like Claude for Chrome that integrate with productivity suites (Gmail, Docs, Calendar) face risk of automated, agent-mediated data exfiltration if any installed extension is compromised, undermining the security assumptions of agentic browser automation and tool-use pipelines.
Affected Systems
Claude for Chrome browser extension (Anthropic), Google Workspace accounts (Gmail, Google Docs, Google Calendar) connected via Claude for Chrome's agentic browsing features; affects users with Claude for Chrome installed alongside any other browser extension with script-injection permissions on claude.ai
Indicators of Compromise
- No specific file hashes, IPs, or domains published; indicator of compromise is presence of any unauthorized or unaudited third-party browser extension with content-script access to claude.ai combined with anomalous Claude for Chrome agent task logs (unexpected Gmail/Docs/Calendar read actions)
Remediation Steps
- 1
Audit installed browser extensions
Review and remove any browser extensions with unnecessary or broad permissions, especially those able to run scripts on claude.ai or other sensitive origins.
- 2
Restrict Claude for Chrome connected services
Limit or disconnect Gmail, Google Docs, and Calendar integrations from Claude for Chrome until Anthropic issues a full fix for the cross-extension trust boundary.
- 3
Apply Anthropic security updates
Monitor Anthropic's advisories and apply patches or configuration changes addressing this flaw and the related ClaudeBleed issue as soon as they are released.
- 4
Enforce extension allowlisting
Use enterprise browser management policies to allowlist approved extensions and block installation of unvetted third-party extensions, particularly on endpoints running AI browser agents.
- 5
Monitor agent task logs
Enable and review logging of Claude for Chrome's agentic actions to detect unexpected or unauthorized data access events.
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.