"ClaudeBleed Reopened": Rogue Browser Extensions Can Still Drive Claude for Chrome to Read Gmail and Calendar

Anthropic's Claude for Chrome browser extension through v1.0.80 (released July 7, 2026) in "Act without asking" mode, with access to connected Gmail, Google Docs, Google Calendar, and Salesforce

Any co-installed browser extension able to inject scripts into claude.ai can silently trigger Claude's pre-approved agentic tasks, abusing its connected-account access to read recent Gmail, open the user's latest Google Doc and its comments, read the calendar and create meetings, or modify Salesforce leads, all without a genuine user action. Manifold Security reported that the bypass remained about six lines of JavaScript across eight releases and stayed unpatched at disclosure

Two trust-boundary defects. The extension's approval click handler never checked the browser's `event.isTrusted` property, so a synthetic (script-generated) click was accepted as a real user gesture; and the Claude side panel initialized in privileged mode whenever loaded with `?skipPermissions=true` in its URL, with no user gesture or consent, turning any URL-construction bug into a silent-execution path. A follow-on to the earlier "ClaudeBleed" issue whose pre-approved-task-list mitigation Manifold showed was still bypassable. Reported to Anthropic on May 21, 2026 by Ax Sharma (Manifold Security)