Executive Summary
Researchers say any browser extension that can run a script on claude.ai can still trigger Claude for Chrome tasks against your Gmail, latest Google Doc and Calendar, a narrower path than ClaudeBleed, which Anthropic partly restricted in May.
What Happened
Any other browser extension that can run a script on claude.ai can still trigger Claude for Chrome tasks aimed at your Gmail, your latest Google Doc and its comments, and your Calendar. Both this and ClaudeBleed need a rogue extension that can already run a script on claude.ai; the difference is scope. Anthropic restricted the arbitrary-prompt path in May as part of its response to the
Affected Products
- Claude for Chrome
- Gmail
- Google Docs
- Google Calendar
Vulnerability / Attack Technique
Rogue extension triggering AI browser agent tasks
Technical Mechanism
A script injected on claude.ai invokes Claude for Chrome's predefined tasks that read Gmail, Docs and Calendar.
AI Security Category
LLM06:2025 Excessive Agency
Part of the AI Agent Excessive Agency topic.
Relevant Frameworks
RealGround Analysis
Other extensions can borrow the agent's access. RealGround analysis: limit extensions on browsers where AI agents hold account access.
Recommended Controls
- Allowlist browser extensions where Claude for Chrome is used
- Limit connected Google services
Related RealGround Service
AI Agent Business Logic Audit · or start with the free AI Agent Security Scanner.
Sources
thehackernews.com: https://thehackernews.com/2026/07/claude-for-chrome-flaw-lets-other.html
Summary and analysis written by RealGround from the source above; last updated 2026-10-18.