If it's only Claude in the browser, performing clicks for you - i don't think there's a lot of extra capabilities you get, compared to what you have already when you get someone to install the extension.
After all, why communicate with a different browser extension, when you already have a browser extension running?

However, still not great sandboxing by anthropic obviously.

Any extension can request the scripting permission to inject JavaScript; that is true. Extensions are a huge security issue, but that's not the full story here.

When an extension does so on claude.ai, the Claude extension's externally_connectable manifest values allow that malicious script to send messages to the Claude extension itself, without explicitly requesting the runtime permission usually required for message sending. As a result, the injected code can't just watch the DOM—which again, yes, is a thing all extensions can do—, it can send messages to Claude via the extension, gaining access to Claude itself and the data stored therein.

Interestingly, it would seem the "fix" from Anthropic to add additional approvals for certain actions is also bypassable.

So, for the demonstrated exploits, the claude extension doesn't really seem to add any new capabilities beyond what an installed extension can do anyways.

(btw #opencode is insecure crap, too, yet it has a scary amount of users)

2001: I'm afraid I can't do that...

2026: I'm afraid I *can* do that!

"AI"... Service with a smile!