ClaudeBleed Reopened: Claude for Chrome Flaw Survives 8 Patches at CVSS 9.6
Eight versions of Claude for Chrome have shipped since Manifold Security reported two vulnerabilities to Anthropic in May. The content script click handler and side-panel initialization code in v1.0.80 — released July 7 and available to every paid Claude subscriber — are byte-for-byte identical to v1.0.72, the version Manifold originally tested. The internal tracking issue covering this class of vulnerability was marked “Resolved” before June 9. Neither finding has been patched.
The Mechanism
When Anthropic fixed ClaudeBleed — the earlier flaw that let any webpage inject arbitrary prompts into the extension — it narrowed external callers to nine fixed task IDs baked into the bundle. Three of the nine access user data: usecase-gmail reads recent Gmail and attempts unsubscribes, usecase-gdocs opens the latest Google Doc and reads all comments, usecase-calendar reads Calendar and can create meetings. The remaining six cover onboarding tutorials and interactions with DoorDash, Salesforce, and Zillow.
The weakness is in what pulls the trigger. A content script in the extension listens on claude.ai for clicks on a specific DOM element with a data-task-id attribute. Any browser extension with a content script on claude.ai can construct the element, set the task ID, and dispatch a synthetic click. The handler does not check event.isTrusted — the browser flag that distinguishes real user clicks from scripted ones.
Manifold demonstrated the trigger with six lines pasted into the claude.ai console, with isTrusted: false confirmed in the event log.
Severity Split
In the extension’s default “ask before acting” mode, a confirmation dialog appears before any sensitive data is accessed. Manifold rates this CVSS 7.7 High. The forged click still gets Claude to load the prompt; a real user approval is still required.
In “Act without asking” mode — the extension’s autonomous setting, available to every user after onboarding — the task executes silently. No dialog appears. Manifold rates this CVSS 9.6 Critical.
The Structural Risk
The second finding is architectural. When Claude’s side panel loads with ?skipPermissions=true in its URL, it initializes directly in skip_all_permission_checks mode — maximum autonomy, no per-action consent. A warning banner appears, but it renders after the privileged session has already opened. It is a notification, not a gate.
Today, only the extension itself constructs that URL, which limits direct exploitability. The risk is structural: any future bug that exposes side-panel URL construction to a lower-privileged context — a new message handler that accepts URL strings, a same-extension XSS in the options page, a regression in an existing handler — combines with the synthetic-click path to achieve silent privileged execution against all nine task types, including Gmail, Docs, and Calendar.
Manifold’s fix is a single line: check event.isTrusted at the top of the click handler. It has not shipped.
Anthropic’s Response
Anthropic acknowledged both reports the day after Manifold filed them. The synthetic-click report was closed on the grounds that the trust-boundary issue was already tracked under the original ClaudeBleed report, “which remains open pending a complete fix.” The URL-parameter report was closed as informative, with the view that the extension constructs that URL only for tasks the user has pre-authorized.
The internal tracking issue was marked Resolved sometime before June 9. Eight releases shipped after that. Manifold verified on July 7 that both findings remain reproducible.
There is no CVE and no public advisory from Anthropic as of July 14. Claude for Chrome is labeled a beta product.
Pattern
Claude for Chrome has hit this class of failure repeatedly. An earlier flaw let any website silently inject prompts. ClaudeBleed followed in late April. GhostApproval, disclosed by Wiz separately on July 8, showed Claude Code hitting the same trust-boundary failure at the filesystem layer: the agent identified a dangerous target in its internal reasoning, then showed the user a harmless filename.
Three separate teams, three separate disclosures, the same structural gap: a safety boundary that works at one layer and fails at another.