Claude in Chrome: What the Browser Extension Does (and Its Real Risks)

Claude in Chrome is not a smarter autocomplete for your browser. It is Claude holding the mouse.

On August 3–4, 2026, Anthropic's browser extension remained in open beta on all paid Claude plans — no free tier, Chrome only. Instead of pasting a URL into a chat box and getting a summary back, you open a side panel next to whatever tab you're on and Claude reads the page, clicks buttons, fills forms, and moves between tabs on your behalf. That is a genuinely different risk category than a chatbot, and Anthropic's own safety documentation says so in plain language: prompt injection is "the biggest risk facing browser-using AI tools," and "the risk is not zero."

This post covers what the extension actually does, who can get it, the permission and blocklist model Anthropic ships with it, and a real vulnerability — ShadowPrompt — that shows what happens when those defenses fail in production.

TL;DR

What Claude in Chrome actually does

The extension lives in a side panel, not a floating chat bubble. Claude sees the active tab, can navigate to new URLs, click interactive elements, fill out multi-field forms, and read the resulting page state before deciding its next action — the same read-act-observe loop coding agents use against a terminal, pointed at a browser DOM instead.

Anthropic's own use-case list for the extension includes pulling numbers out of analytics dashboards, organizing Google Drive folders, prepping for calendar meetings by researching attendees, running lightweight competitor research, logging activity into a CRM, and clearing out an inbox. None of that requires reasoning breakthroughs — it requires an agent that can reliably operate UI it didn't design, which is the actual hard part.

It also doesn't work alone. The extension is wired into the rest of Anthropic's agent stack: Claude Cowork can call on it as a browser tool during a larger desktop workflow, Claude Code can use it for web research during a coding session, and Claude Desktop can chain it through connectors. Claude in Chrome is the browser leg of a bigger table, not a standalone product Anthropic expects you to use in isolation.

Availability: beta, paid-only, model tier gated by plan

There's no free-tier path into Claude in Chrome. Availability breaks down by plan:

The model gating matters more than it looks. Opus 4.6 is the model Anthropic cites when it claims sub-0.08% prompt-injection attack success internally — Pro users running the extension on Haiku 4.5 are, by Anthropic's own numbers, working with the weaker of the two injection-resistance profiles.

Browser support is narrower than most Chromium extensions bother to enforce: it's built for Google Chrome specifically. Brave, Arc, and other Chromium-based browsers aren't supported targets even though the extension format is technically compatible, and there's no Firefox build.

The permission model: allowlists, blocklists, and confirmations

Claude in Chrome doesn't get unrestricted browser access by default. Anthropic layers three kinds of controls on top of the base agent:

1. Site blocklists — known piracy and adult-content sites are blocked outright; the extension isn't offered at all to HIPAA-covered organizations.
2. Permission gates on category — financial sites require an explicit permission grant before Claude can act on them; the extension is not available in Claude Cowork for certain regulated contexts.
3. Hard-coded action bans — regardless of permissions, Claude cannot execute stock trades or investment transactions, bypass CAPTCHAs, type in sensitive data like card or SSN fields, or scrape facial images.

On top of the allow/deny layer, every session runs a screenshot pipeline: opening the side panel captures the active tab as an image and folds it into the conversation. Anthropic is explicit that this isn't filtered — "whatever is visible in one of those tabs is captured in the screenshots and becomes part of the conversation." If a sensitive tab is open in the background while you're driving Claude in a different one, that's on you to manage, not the extension.

Why "the risk is not zero" isn't boilerplate: ShadowPrompt

Every AI vendor ships a line about risks not being zero. Claude in Chrome had a concrete case that shows what that means in practice.

Security researchers at Koi Security disclosed ShadowPrompt to Anthropic through HackerOne on December 26, 2025. The bug chained two separate flaws:

• The extension's postMessage listener accepted messages from any subdomain matching *.claude.ai — a wildcard origin check instead of an exact match.
• An older Arkose Labs CAPTCHA component hosted at a-cdn.claude.ai rendered attacker-controlled postMessage payloads as raw HTML via dangerouslySetInnerHTML, without verifying the sender's origin — a classic DOM-based XSS.

Chained together, any website could get JavaScript execution on the trusted a-cdn.claude.ai origin, then use chrome.runtime.sendMessage() to send forged instructions straight into the extension — no user click, no permission prompt, no visible warning. That's the definition of prompt injection at the browser-extension layer: attacker-controlled content becoming attacker-controlled commands.

Anthropic confirmed the report within a day and shipped extension version 1.0.41 on January 15, 2026, enforcing a strict origin check requiring an exact match on https://claude.ai. Arkose Labs patched the underlying CAPTCHA XSS separately on February 19, 2026, and Koi Security verified full remediation on February 24, 2026 — roughly two months from disclosure to closed loop.

That timeline is the argument for Anthropic's own safety guidance, not against it: the classifiers and RL training that screen for injected instructions are a second line of defense, not the only one, and this bug lived entirely in the plumbing underneath them.

What people are asking: financial sites, work accounts, HIPAA

Can I let it manage my brokerage account? No — trading and investment transactions are hard-blocked regardless of plan or permission, and financial sites in general require you to explicitly grant access first.

Can my company use it with patient or health data? No. Claude in Chrome isn't offered to HIPAA-covered organizations at all — this isn't a configuration toggle, it's excluded by policy.

What about work accounts with sensitive internal data? Anthropic's guidance explicitly lists work accounts with sensitive data, legal documents, and other people's personal information alongside financial and medical data as categories to keep away from the extension, beta status notwithstanding.

Does "beta" mean it'll get more locked down or more open over time? Given the ShadowPrompt timeline — disclosure to patch in under three weeks, full remediation in about two months — the more likely trajectory is tighter allowlists and more granular permission prompts as Anthropic keeps finding edge cases through its bug bounty program, the same pattern visible in Cowork's evolving security posture.

Claude in Chrome vs. the rest of Anthropic's browsing stack

It's easy to conflate Claude in Chrome with Anthropic's other browser-adjacent features, so here's the split:

Claude in Chrome is the narrowest of the four in scope but the most exposed in practice — it's the one sitting directly in your day-to-day browsing session, next to your actual logged-in tabs, which is exactly the surface ShadowPrompt targeted.

Setup and first-use checklist

1. Install from the Chrome Web Store via the "Add to Chrome" button on claude.com/claude-for-chrome — requires a paid Claude plan to activate.
2. Open the side panel on a low-stakes tab first (a public docs page, not your bank) to see how Claude narrates its planned actions before it takes them.
3. Leave confirmation prompts on for anything touching a financial, legal, or work-sensitive site — don't flip to an "act without asking" style mode until you've watched Claude operate on trusted content.
4. Close unrelated sensitive tabs before opening the side panel — screenshots capture whatever's visible in the active tab, unfiltered.
5. Keep the extension updated; the ShadowPrompt fix only helps you if you're actually on 1.0.41 or later.

The takeaway

Claude in Chrome is the clearest signal yet that Anthropic is betting on agents that act inside existing software rather than requiring new APIs for everything — the same logic behind Cowork and the Claude Code desktop browser. The capability is real: form-filling and multi-tab research genuinely save time. But it's beta software with a documented exploit history, hard limits Anthropic won't loosen (no trading, no CAPTCHA bypass, no HIPAA orgs), and a permission model that puts real weight on you to keep sensitive tabs away from it. Treat the "risk is not zero" line as a specification, not a disclaimer.

Related on explainx.ai:

• How to Use Claude Cowork Safely: Official Security Guide
• Claude Code Desktop Browser: Built-In Web Browsing
• Browserbase Skills: Claude Code Browser Automation
• Claude Sonnet 5 Launch Guide
• Claude vs ChatGPT for Work

Official documentation: Claude for Chrome product page · Use Claude in Chrome safely — Claude Help Center

Feature availability, model access, and version numbers reflect Anthropic's documentation as of early August 2026 and may change as the beta progresses.