ClaudeBleed: a zero-permission extension hijacks Claude for Chrome

On 8 May 2026, CyberScoop, SecurityWeek and CSO Online each reported the same finding from the browser-security firm LayerX: Anthropic's Claude in Chrome extension would accept instructions from any other Chrome extension installed in the same browser, including one that requests no permissions at all. LayerX named the flaw ClaudeBleed and demonstrated it driving the agent to pull files from Google Drive and share them with an outside party, read and send Gmail, and copy code out of a private GitHub repository. The exposure fell on anyone running the extension with browser control granted and Google or GitHub connected; no real-world exploitation has been recorded. The archive dates this record 12 May 2026, the day Colombia's health-sector CSIRT issued alert 099 on the same flaw. The full record, including the archive's own severity, confidence and harm grades, lives in the Orca AI Incident Archive, alongside the browser-agent and extension-hijack entries that neighbour it.

The trust boundary LayerX says was missing

Anthropic's extension runs on claude.ai and, once the user grants it browser control, can act inside other tabs. LayerX's finding was not that the model could be talked into misbehaving, but that the extension's plumbing let a caller it had never vetted reach the model at all. "The flaw stems from an instruction in the extension's code that allows any script running in the origin browser to communicate with Claude's LLM, but does not verify who is running the script," LayerX researcher Aviad Gispan wrote, in the write-up CyberScoop quoted. "As a result, any extension can invoke a content script (which does not require any special permissions) and issue commands to the Claude extension."

SecurityWeek's account puts the same point in Chrome's own terms: the extension trusted the origin of the execution — claude.ai — rather than the execution context. An attacker's extension need only declare a content script configured to run in the page's main world, so that the script executes as part of claude.ai, and then send its message. The Claude extension sees a sender on the trusted origin and complies. Gispan described the result as "a privilege escalation primitive across extensions, something Chrome's security model is explicitly designed to prevent."

What the proof of concept actually did

CyberScoop reported that Gispan could execute any prompt he chose, blow through Claude's safety guardrails, evade the user-confirmation step and act across several Google tools. The demonstrations were concrete: extracting files from Google Drive folders and sharing them with unauthorised parties, surveilling recent email activity and sending mail on the user's behalf, and taking private source code from a connected GitHub repository.

The bypasses are the part worth dwelling on. SecurityWeek reported that LayerX forged user approval by repeatedly re-sending a confirmation message — approval looping — and used DOM manipulation to alter what Claude could see, removing labels and indicators around sensitive items such as passwords and the sharing feedback so that the actions looked legitimate from inside the agent's own view. That is why Ax Sharma, head of research at Manifold Security, told CyberScoop that "the most sophisticated part of this attack isn't the injection, but that the agent's perceived environment was manipulated to produce actions that looked legitimate from the inside."

Reported on 27 April, called a duplicate, partly fixed on 6 May

LayerX reported the flaw to Anthropic on 27 April 2026, according to CyberScoop. Anthropic replied a day later saying the bug was a duplicate of another vulnerability already being addressed in a future update. That update, version 1.0.70, arrived on 6 May and introduced new approval flows for privileged actions.

LayerX's position, as reported by SecurityWeek, is that the fix treated a symptom. Anthropic added internal checks to stop extensions running in "standard" mode from executing remote commands but left the underlying message handler in place. Switch the extension into "privileged" mode — which, Gispan said, happens without the user being notified or asked to approve — and the hijack worked again. CyberScoop reported that Gispan was still able to take over the agent in some scenarios after the patch. Colombia's health-sector computer emergency response team, CSIRT Salud, summarised the same claim in alert 099: the researchers said they had evaded the initial mitigations in roughly three hours.

What is established, and what is only claimed

The archive grades this record as research, severity medium, confidence B, not disputed, with no real harm recorded and AI involvement confirmed. Those grades are worth reading literally. Every account of the original flaw traces back to one source, LayerX's own write-up. CyberScoop, SecurityWeek, CSO Online and CPO Magazine all restate it, and none of the four reports an independent reproduction. Corroboration here means the disclosure is real and consistently described across outlets; it does not mean a second laboratory confirmed the mechanism in May.

Nor is there a CVE. No identifier appears in any of the coverage reviewed here or in the CSIRT Salud advisory; the flaw is tracked by extension version instead. No figure for how many users had the extension installed, or how many had Google or GitHub connected, has been published by Anthropic or LayerX. Anthropic did not respond to CyberScoop's request for comment, and the reporting carries no vendor statement disputing LayerX's account.

Two things about the record are worth flagging rather than smoothing over. The severity grades do not agree: the archive calls it medium, LayerX's write-up called the vulnerability critical, and CSIRT Salud graded its alert "Alto" — high. Those are three judgements by three parties, and this article does not convert one into another. And the primary document is no longer online: LayerX's blog post now returns a 404 on a site that carries an Akamai acquisition banner, so the technical write-up survives here only in the quotations that CyberScoop, SecurityWeek and CPO Magazine carried.

What happened after: still not complete in July

Manifold Security's Ax Sharma, who had commented on the original disclosure, kept looking. In a write-up published on 14 July 2026, Manifold said it had reported two further issues to Anthropic on 21 May 2026 against extension version 1.0.72, and that both still reproduced in version 1.0.80, released on 7 July.

The first was a synthetic-click bypass. Anthropic's mitigation had replaced arbitrary prompt text with nine hardcoded task identifiers — among them usecase-gmail, usecase-gdocs, usecase-calendar and usecase-salesforce — that a page could trigger but not rewrite. Manifold found that the click handler which fires them never checks event.isTrusted, so any content script on claude.ai can build the button, set the task identifier and dispatch a fake click. In the default "Ask before acting" mode a user still sees an approval prompt; with "Act without asking" enabled, the read happens silently. Manifold rated that path CVSS 7.7 in default mode and 9.6 in the silent one, and stressed that the bug sits in the extension rather than the model, reproducing across Opus, Sonnet and Fable side-panel model selections.

The second was architectural. The side panel reads a skipPermissions=true parameter from its own URL and boots into skip-all-permission-checks mode with no user gesture and no consent step. Manifold said that path was not remotely exploitable in 1.0.80 on its own, but that it converts any future URL-construction bug into silent privileged execution. Anthropic closed the first report as already covered by the internal trust-boundary issue — which the company said "remains open pending a complete fix" — and closed the second as informative.

Those CVSS scores belong to Manifold's findings, not to LayerX's original ClaudeBleed, and should not be read back onto it. What they do establish is that an independent lab, weeks later, could still drive Claude from another extension's script. That is the strongest corroboration available for the class of flaw LayerX described, though it is not a reproduction of LayerX's own proof of concept.

Why a zero-permission extension is the point

Chrome's extension model is built on declared permissions: an extension that asks for nothing is supposed to reach almost nothing. ClaudeBleed inverted that by making the assistant the thing that holds the permissions and then letting a permissionless caller borrow them. Gispan's framing, as quoted by CyberScoop, is that the flaw "effectively breaks Chrome's extension security" by creating a privilege escalation primitive across extensions.

For defenders the practical residue is the one Sharma named: monitoring the prompt stream does not help when the attacker has changed what the agent perceives as its own interface. The visible actions are the user's own clicks and confirmations, replayed or fabricated. LayerX's suggested direction, per CPO Magazine, was extension-to-page authentication tokens to bind callers, plus real user approvals. That is a plumbing fix, not a model-behaviour fix.

As of the reporting reviewed here, no public Anthropic advisory for ClaudeBleed has appeared. The record stands as a research finding with a demonstrated proof of concept, a partial fix that researchers say was bypassed within hours, and a residual gap that a second firm reported still open in July.