Claude Chrome Extension Fails to Validate Trusted Events, Enabling AI Action Hijacking
The root cause of this vulnerability is a missing input validation check: the Claude Chrome extension did not verify the `Event.isTrusted` property before executing AI workflows, meaning programmatically simulated clicks from malicious extensions were treated as legitimate user actions. This matters because Claude operates with authenticated access to sensitive SaaS platforms — Gmail, Google Docs, Google Calendar, and Salesforce — meaning a successful exploit could allow an attacker to exfiltrate data, send emails, or manipulate calendar events without the user's knowledge. The attack surface is expanded by the permissive nature of the browser extension ecosystem, where any installed extension can interact with another's DOM events. This incident highlights how AI-powered browser agents introduce new privilege escalation vectors that traditional security models were not designed to address. Developers of AI-integrated extensions must treat all programmatic inputs as untrusted by default.
Tactical Insight
Immediate actions
- Audit all installed browser extensions and remove those from unknown or unverified publishers.
- Revoke and re-scope OAuth permissions granted to the Claude extension to apply least-privilege access across Gmail, Google Docs, and Salesforce.
- Monitor Anthropic's security advisories and apply any patched extension updates as soon as they are released.
Long-term improvements
- Require enterprise browser management policies (e.g., via Chrome Enterprise) to allowlist approved extensions and block unapproved installations.
- Implement code reviews and automated security testing for browser extension projects to validate `Event.isTrusted` and similar browser security properties before release.
- Establish a formal third-party/plugin risk assessment process before approving AI-integrated tools for corporate SaaS environments.
Detection measures
- Enable audit logging on connected SaaS platforms (Gmail, Salesforce, Google Workspace) to detect anomalous automated actions triggered outside normal user patterns.
- Deploy browser telemetry or EDR solutions capable of monitoring inter-extension communication and flagging suspicious DOM event injection activity.