A critical vulnerability in Anthropic’s Claude for Chrome browser extension may enable malicious extensions to simulate user actions, potentially allowing them to exploit Claude’s access to services like Gmail, Google Docs, Google Calendar, and Salesforce.
This issue was identified by Ax Sharma from Manifold Security, who noted that the problem arises from how the Claude extension validates user-initiated requests for built-in tasks.
Chrome extensions with permissions can inject JavaScript into web pages, allowing them to alter content, read displayed information, and execute click and keyboard events programmatically.
According to the Manifold report, the Claude extension listens for click events on specific elements to execute built-in AI workflows designed for connected services, including:
- Gmail Use Case: Read recent emails and identify promotional content
- Google Docs Use Case: Access the latest Google Doc to review comments and feedback
- Calendar Use Case: Analyze your calendar for available slots and schedule meetings
- Salesforce Use Case: Modify a Salesforce lead and convert it to an opportunity
Researchers found that the extension accepts synthetic click events generated by JavaScript without checking if they originated from actual user actions.
In genuine user interactions, the browser sets the Event.isTrusted property to true. However, events generated by scripts are marked as false, enabling a clear distinction between real user actions and automated scripts.
Manifold Security indicates that the Claude extension fails to confirm the authenticity of click events using the Event.isTrusted property prior to executing workflows.
A malicious extension capable of altering content on the claude.ai domain could inject elements containing task identifiers and produce synthetic click events.
Despite the browser identifying the event as untrusted, the Claude extension inaccurately recognized it as a legitimate click, executing the corresponding AI action.
While the flaw does not permit arbitrary prompt injection, it restricts attacks to nine predefined tasks embedded in the extension.
Moreover, this vulnerability does not enable direct compromise of the Claude extension from websites; the attacker must convince users to install a malicious extension that interacts with claude.ai.
Although malicious extensions commonly wield extensive access to web pages, this flaw allows them to exploit Claude’s authenticated access to vital services.
The overall impact hinges on the configuration of the Claude extension and whether users authorize sensitive actions or activate Claude’s optional “Don’t ask, act” setting, permitting workflows to execute automatically.
The researchers also determined that the skipPermissions=true parameter could bypass specific permission checks when initiating the extension.
Yet, this mechanism isn’t directly exploitable and requires an additional vulnerability to craft a specialized URL.
Both vulnerabilities were reported to Anthropic through its bug bounty program. The company acknowledged the findings, addressed the synthetic click issue, and noted it was a recognized problem. The second flaw related to the internal SkipPermissions=true parameter was categorized as Informational.
Manifold reports that the flaw persists in the latest version of the browser extension (1.0.80), released on July 7th.
“As of July 7, 2023, both findings are reproducible in version 1.0.80. The content script and side panel handler cited remain identical to the v1.0.72 source,” the report states.
Security teams document 54% of successful attacks yet issue warnings for only 14%. The remainder goes undetected in the environment.
Picus’ whitepaper outlines strategies for testing your SIEM and EDR rules through breach and attack simulations, ensuring threats don’t go unnoticed.
Source: www.bleepingcomputer.com