Claude Chrome Extension Vulnerable to Hijacking by Malicious Extensions
A vulnerability called "ClaudeBleed" in Anthropic's Claude Chrome extension allows malicious extensions to hijack Claude's browser automation capabilities and access sensitive data like Gmail and Google Drive without requesting special permissions. Researchers at LayerX found the flaw stems from insufficient verification of scripts communicating with the extension, and despite a security update, the extension remains vulnerable to prompt injection attacks.
What happened
Security researchers at LayerX discovered a vulnerability called 'ClaudeBleed' in Anthropic's Claude Chrome extension that allows malicious extensions to hijack Claude's browser automation capabilities.
The flaw stems from insufficient verification of scripts communicating with the extension. The extension relied on Chrome's 'externally_connectable' feature but trusted scripts running under the claude.ai origin without verifying whether those scripts genuinely came from Anthropic or had been injected by another extension.
Even a zero-permission extension could potentially send commands to Claude's internal messaging interface and gain control over select browser capabilities, weakening Chrome's extension isolation model.
Reported impact
The vulnerability could allow attackers to access sensitive information from authenticated browser sessions across services such as Gmail, Google Drive, and GitHub.
Malicious websites could embed hidden text or instructions that manipulate Claude's behaviour, forcing the AI assistant to reveal private information, follow malicious instructions, or generate misleading outputs without the user noticing.
Index analysis
Anthropic released a security update aimed at reducing the risks and improving how the extension identifies and ignores suspicious hidden instructions inside webpages.
However, researchers claimed the protection measures are still not fully effective and that attackers may bypass the safeguards using specially crafted webpage content and indirect prompt injection methods.
Governance controls
Anthropic acknowledged the continuing risks and said it is working on stronger protections. The company released version 1.0.70 to patch the flaw, but experts warned that autonomous browsing modes may still leave users exposed to potential exploitation.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.