Source: Manifold Security — 2026-07-14
Summary
Manifold Security shows that any installed Chrome extension with a content script running on claude.ai can forge a synthetic click event to trigger one of nine hidden prompts that invoke Claude for Chrome's "Act without asking" autonomous mode — silently reading the victim's Gmail, Google Docs, and Calendar with no visible confirmation. The underlying synthetic-click gap, plus a related side-panel permission issue, was reported to Anthropic on May 21, 2026, acknowledged and marked "Resolved" internally by June 9, but Manifold reproduced the exact same bypass live in v1.0.80 on July 7 — eight releases after the original ClaudeBleed patch it was meant to fix.
Key Takeaways
- The exploit is cheap to pull off: Manifold describes it as roughly six lines of JavaScript — any extension with a content script on claude.ai can inject a DOM element and dispatch a synthetic, forged click event.
- That forged click is enough to trigger one of nine pre-set prompts wired to Claude for Chrome's "Act without asking" mode — the setting meant to let the agent skip per-action confirmation for pre-approved tasks.
- Once triggered, the rogue extension can walk Claude for Chrome into silently reading the victim's Gmail, Google Docs, and Calendar content — no interaction with the malicious extension's own UI, no visible prompt shown to the user.
- The disclosure timeline shows how stale the fix is: reported to Anthropic May 21, 2026; acknowledged and marked "Resolved" internally by June 9; reproduced live by Manifold in v1.0.80 on July 7 — eight shipped releases after Anthropic's original ClaudeBleed patch.
- Manifold's practical mitigation for users today: turn off "Act without asking" in Claude for Chrome, since that setting is the actual surface being abused, not a patchable code path users can otherwise avoid.
Reel Script
Hook (~18s, 42 words): If you use Claude's Chrome extension with "Act without asking" turned on, any other extension sitting in your browser can silently trigger it to read your Gmail. Researchers say this is still true today — months after Anthropic said the underlying bug was fixed.
Core Concept (~65s, 150 words): Every Chrome extension can inject what's called a content script — a small piece of JavaScript that runs on top of whatever page you're viewing, including claude.ai. That's normally harmless, used for things like grammar checkers or price trackers. The bug here is that a rogue extension's content script can fake a real user click: not visibly click a button, but generate a synthetic click event inside the page's code that Claude for Chrome can't distinguish from a genuine one. Claude for Chrome has an "Act without asking" mode built to skip confirmation prompts for actions you've pre-approved, so the agent can move faster on trusted tasks. The forged click lands directly on that pre-approved, no-confirmation path — meaning the agent takes action without any human actually touching anything.
Hands-On (~55s, 125 words): Manifold says the whole bypass comes down to about six lines of JavaScript: inject a hidden element into the claude.ai page, then dispatch a synthetic click event at it, landing on one of nine prompts wired to auto-run under "Act without asking." From there, Claude for Chrome — still fully authenticated as the real, logged-in user — can be walked into reading Gmail, Google Docs, and Calendar content and handing it back to the rogue extension's own script. The timeline is the damning part: Manifold reported this in May, Anthropic acknowledged it and marked their internal tracker "Resolved" by June, and Manifold reproduced the identical bypass in the current version, v1.0.80, in July — eight releases after that fix supposedly shipped.
Takeaway (~22s, 50 words): If you run Claude for Chrome alongside other extensions, "Act without asking" is currently the riskiest setting you can leave on — the safe move today is turning it off, not waiting on a patch that's already missed one fix cycle. Check that setting before your next work session.