Claude Chrome Extension Vulnerability Allows Malicious Extensions to Trigger AI Actions in Gmail, Docs, Calendar, and Salesforce

Claude Chrome Extension Vulnerability Allows Malicious Extensions to Trigger AI Actions in Gmail, Docs, Calendar, and Salesforce

What Happened — A security researcher identified that Anthropic’s Claude for Chrome extension does not verify the Event.isTrusted flag before executing one of its nine built‑in AI workflows. A malicious Chrome extension can inject a synthetic click event, causing Claude to act on connected services (Gmail, Google Docs, Calendar, Salesforce) without genuine user interaction.

Why It Matters for Compliance & Audit Readiness

• Demonstrates a gap in SOC 2 Access Controls: the extension accepts untrusted input, violating the principle of least privilege and logical access verification.
• Highlights the need for continuous evidence of control testing (e.g., automated UI‑event validation) to prove that access‑control policies are enforced in production.
• Provides a concrete example of why security‑awareness training for developers and third‑party extension vetting is essential to maintain a defensible audit trail.

Who Is Affected — SaaS platforms that integrate with browser extensions (AI assistants, productivity tools), enterprise users of Anthropic Claude, and organizations that rely on Chrome extensions for workflow automation.

Recommended Actions

• Map the flaw to SOC 2 CC6.1 (Logical Access Controls) and update the control to require verification of Event.isTrusted for all UI‑triggered actions.
• Enforce a least‑privilege extension policy: only allow vetted extensions with explicit business justification to run on claude.ai.
• Add automated testing that simulates untrusted events and logs any unauthorized workflow execution as audit evidence.
• Conduct a security‑awareness session for developers on handling browser‑generated events and third‑party extension risks.

Source: BleepingComputer

Technical Notes

• Attack vector: malicious Chrome extension injecting JavaScript that generates synthetic click events.
• No CVE assigned yet; the flaw is a logic error in event‑trust validation.
• Affected workflows: Gmail unsubscribe, Doc comment read, Calendar slot creation, Salesforce lead conversion, etc.

Source: BleepingComputer