Claude for Chrome Vulnerability Allows Rogue Extensions to Trigger Gmail Reads
Researchers reveal that malicious extensions can access Gmail data through a security flaw.
1Introduction
The Claude for Chrome extension enables users to interact with services like Gmail, Google Docs, and Calendar. However, researchers have discovered that the extension has security vulnerabilities, allowing malicious extensions to access user data.
2Source of the Vulnerability
Claude for Chrome accepts scripts running on claude.ai. This means a malicious extension can create fake clicks to access services like Gmail. Researchers note that this vulnerability was reported in May but remains unpatched.
3Fake Click Mechanism
The extension listens for clicks on a specific element on claude.ai and treats them as genuine user clicks. However, since the event.isTrusted flag provided by the browser is not checked, fake clicks are also processed as real.
4Risks
This vulnerability can access sensitive user data like Gmail, Google Docs, and Calendar. Especially if the 'Act Without Asking' mode is enabled, fake clicks can be executed automatically without any approval, indicating serious risks to user data.
5Temporary Solution
Users can protect themselves from this vulnerability by turning off the 'Act Without Asking' mode and reviewing extensions with permission to read or modify data on claude.ai. However, this solution does not completely eliminate the fake click path.
6Future Threats
Researchers warn that a future vulnerability could turn this fake click mechanism into a completely silent account read operation. This means user data could be at even greater risk.
7Conclusion
The security vulnerability in the Claude for Chrome extension poses a serious threat to user data protection. Researchers emphasize the need for immediate patching and recommend users take temporary precautions.