Claude for Chrome leaks Google data

Published July 7, 2026

Claude for Chrome, an AI chatbot extension, has two unpatched flaws that let other browser extensions secretly read your Gmail, Google Docs, and Calendar. Attackers can trigger these actions without your knowledge if you have 'Act without asking' turned.

Report priority
High
Targets
Claude for Chrome

How it works

Attackers use six lines of JavaScript to fake a click on Claude's onboarding button, tricking it into running hardcoded prompts that access your Google data without your permission.

What to do

Check if you have Claude for Chrome installed and running version 1.0.80 or older by typing chrome://extensions in your browser and looking for Claude for Chrome in the list.

Update Claude for Chrome to the latest version or disable the extension until an official patch is released. Turn off 'Act without asking' in Claude's settings to prevent silent data access.

Technical details

An attacker installs a malicious Chrome extension that targets claude.ai. When you visit claude.ai, the attacker's extension sends a fake click event to Claude's onboarding button. Claude, thinking it's you, opens your Gmail, reads emails, and even clicks unsubscribe links, all silently if 'Act without asking' is enabled.

The Claude for Chrome browser extension contains two unpatched vulnerabilities that expose users' Gmail, Google Docs, and Calendar data. The first flaw lies in its content script, which lacks proper validation for user-initiated events (event.isTrusted). Attackers with script access to claude.ai (a common permission) can trigger malicious prompts via six lines of JavaScript, bypassing user consent.

Three of these prompts allow silent access to read emails, modify Google Docs, and create Calendar events, especially dangerous if the user has "Act without asking" enabled (CVSS 9.6, Critical). The second issue stems from Claude's side panel entering a privileged, no-consent mode when loading URLs with?skipPermissions=true, with no user interaction required. While currently limited to internal use, this design could enable future silent account access if exploited via an XSS flaw or similar attack.

Both vulnerabilities align with OWASP's AI security risks (prompt injection and excessive agency). Despite fixes being proposed, such as enforcing event.isTrusted and removing URL-based privilege escalation, the issues remain unresolved in version 1.0.80 (released July 7, 2026). Researchers first reported them in May 2026.

References

View Original Source