How to Audit and Secure Your Claude Chrome Extension Against Cross-Extension Hijack Attacks
The ClaudeBleed vulnerability disclosed on May 7, 2026, exposed a critical flaw in Anthropic’s Claude Chrome extension: any other extension — including zero-permission ones — could hijack the Claude agent session, exfiltrate data from Gmail, Drive, and GitHub, and execute unauthorized commands on the user’s behalf. Anthropic released a patch (v1.0.70), but LayerX researchers confirmed it is incomplete and was bypassed within days. Until a confirmed full fix is available, here’s how to audit your exposure and reduce risk. ...