Researchers Say Claude for Chrome Flaw Lets Rogue Extensions Trigger Gmail Reads

A vulnerability in Claude for Chrome allows malicious browser extensions to trigger tasks that access a user's Gmail, Google Doc, and Calendar. This can happen if a rogue extension can run a script on claude.ai. The issue requires a malicious extension that already has the ability to run scripts on claude.ai. The scope of this vulnerability differs from another issue known as ClaudeBleed, which also relies on a rogue extension with script-running capabilities. The vendor, Anthropic, had previously restricted the arbitrary-prompt path in response to related concerns.