Claude in Chrome bug can hijack Gmail-linked accounts
Researchers found a way to trick Claude's Chrome browser assistant into reading hidden instructions inside an email. Once tricked, it can grab sign-in codes from Gmail and use them to break into a victim's Slack, X, or Claude.ai account.
- Report priority
- Medium
- Targets
- Claude in Chrome+3 more
How it works
- An attacker sends a victim an email containing hidden instructions disguised as normal text.
- When the victim asks Claude in Chrome to review or summarize their inbox, the assistant reads those hidden instructions along with the real email.
- The hidden instructions push Claude into loading a booby-trapped code package that looks like a routine tool but secretly runs extra code inside the victim's open browser session.
- Because the browser is already logged into Gmail, that code can check the inbox for verification emails without a separate login.
- The attacker then starts a login or password-reset flow on Slack, X, or Claude.ai, waits for the confirmation code or link to arrive, and has Claude's browser session fetch it.
- The attacker uses that stolen code to finish the login and take over the account.
What to do
If you use the Claude in Chrome extension and have granted it access to read your Gmail, check whether you have turned on Gmail access for Claude in Chrome and whether you regularly ask it to summarize or act on your inbox. Zenity says its reports to Anthropic were filed in late 2025 and early 2026 and were classified as informative, so no confirmed fix status is public.
No confirmed patch for this chain is documented in the available reporting, so consult Anthropic's own advisories for the latest guidance on Claude in Chrome. Until then, avoid letting Claude in Chrome read or act on inbox content, and where possible use an authenticator app or hardware security key instead of email codes for Slack, X, and Claude.ai sign-in, since those cannot be intercepted this way. Treat any unrequested verification email as a warning sign.
Technical details
Affected software: Claude in Chrome, Gmail, Slack, Claude.ai
The proof of concept uses indirect prompt injection: hidden text in an email is interpreted by the Claude in Chrome agent as instructions rather than content. Those instructions cause the agent to load a package from an attacker-controlled registry disguised as a trusted content delivery network; the package returns a valid-looking result while quietly running additional JavaScript in the victim's authenticated browser session. That code queries Gmail's Atom feed using the victim's existing session cookies to find and read verification emails, letting the attacker complete email-based login or account-recovery flows for Slack, X, and Claude.ai without authenticating themselves.