Unpatched Claude for Chrome Flaw Lets Malicious Extensions Trigger AI Actions on Gmail, Salesforce

A vulnerability in Anthropic's "Claude for Chrome" browser extension allows malicious extensions to trigger the AI assistant's pre-defined workflows without genuine user interaction, potentially exposing connected services such as Gmail, Google Docs, Google Calendar, and Salesforce. The issue, discovered by Ax Sharma of Manifold Security, remains unpatched in the latest release despite being reported months earlier, according to reporting on the finding BleepingComputer.