FlashFeed

Full text

Anthropic’s Claude extension flaws allow fake clicks to launch sensitive AI workflows

Researchers found vulnerable handlers unchanged across eight extension updates

Synthetic clicks bypassed checks designed to confirm real user actions

Security researchers at Manifold Security have claimed Anthropic's Claude for Chrome browser extension contains two unpatched vulnerabilities in version 1.0.80, released July 7, 2026.

According to Manifold Security , it first reported both vulnerabilities to Anthropic through the company's bug bounty program on May 21, 2026, and received acknowledgment the following day.

The first flaw lets any browser extension trigger nine predefined Claude workflows by simulating a synthetic user click on claude.ai.

Nine workflows and one missing check

Researcher Ax Sharma found that the extension never verified whether a click event carried the Event.isTrusted property before acting on it.

Under default settings, the vulnerability received a CVSS score of 7.7 High, increasing to 9.6 Critical when users enabled automatic execution because Claude could perform actions without approval.

The nine hardcoded tasks include reading Gmail, opening Google Docs, checking Google Calendar, and modifying Salesforce leads without asking.

Because the browser marks synthetic clicks as untrusted, the extension should have rejected them but instead executed the workflow anyway.

Manifold Security confirmed on July 7 2026 that both vulnerabilities still work against version 1.0.80, months after first reporting them to Anthropic.

Anthropic released eight separate versions between 1.0.73 and 1.0.80 without altering the specific handlers’ researchers had already flagged as vulnerable.

The company closed the synthetic-click report, saying an existing internal report already tracked the broader trust-boundary issue researchers had described in detail.

However, Sharma believes the fix required only one additional line of code to verify the click event's isTrusted property before allowing the workflow to continue.

A second, structural weakness

A second flaw involves a side-panel URL parameter called skipPermissions, which can activate a privileged mode without any consent prompt.

When the parameter is set to true, the panel begins skipping permission checks entirely, allowing Claude to act without asking the user first.

Manifold notes that only Anthropic's own scheduled-task feature is supposed to construct this kind of privileged URL internally right now.

The panel, however, honours that parameter regardless of which script or page actually constructed the originating URL string in practice.

One example task lets Claude read a user's Gmail inbox, identify promotional messages, and automatically click the unsubscribe links inside them.

Manifold warns that "the bypass is still six lines of JavaScript," months after researchers first flagged the underlying issue to Anthropic.

Anthropic classified this second finding as informational, arguing that the parameter is only ever constructed by its own internal systems.

Manifold said the content-script and side-panel code linked to both vulnerabilities remained byte-identical across the eight subsequent extension releases examined after the original report.

The flaws were also reproduced across Claude's Opus, Sonnet, and Fable side-panel model selections, indicating that the issue affected the extension's security design rather than the underlying artificial intelligence models.

The report also connected the findings with OWASP concerns involving LLM01: Prompt Injection and LLM06: Excessive Agency risks in AI applications.

The researchers noted that abuse involving AI tools may remain difficult to detect because normal browser activity and network connections can appear unchanged while unauthorized AI actions occur.

Full text

Modern vehicles increasingly rely on proprietary repair software.

Independent repair shops face rising costs that threaten competition.

Fewer repair choices could leave drivers paying more over the long term.

Today’s vehicles are safer, smarter, and packed with more technology than ever before, but those advances are coming with a consequence. Software is becoming just as important as nuts and bolts, and independent repair shops say the cost of keeping up with modern vehicles is spiraling out of control. The result? Fewer neighborhood mechanics can afford the specialized tools and subscriptions needed to service today’s cars, potentially leaving drivers with fewer repair options and higher bills.

var adpushup = window.adpushup = window.adpushup || {que:[]};

adpushup.que.push(function() {

if (adpushup.config.platform !== "DESKTOP"){

adpushup.triggerAd("0f7e3106-c4d6-4db4-8135-c508879a76f8");

} else {

adpushup.triggerAd("82503191-e1d1-435a-874f-9c78a2a54a2f");

}

});

Read: A Porsche Oil Light That Couldn’t Be Turned Off Turns Into A Monopoly Lawsuit

A new report from The Detroit News explores how increasingly software-defined vehicles are changing the repair business. While independent shops can generally access factory repair information, many say the growing cost of software, diagnostic equipment, and technician training is making it harder to compete.

Wrenches Aren’t The Problem Anymore

var adpushup = window.adpushup = window.adpushup || {que:[]};

adpushup.que.push(function() {

if (adpushup.config.platform === "DESKTOP"){

adpushup.triggerAd("ea4d4b5a-f8e5-4d5d-9d9a-53a3b956b6cd");

} else{

adpushup.triggerAd("44c0a4dc-e25b-4ba5-ac64-2c510461b92a");

}

});

Stephen Rivers / Carscoops

Years ago, most repairs required little more than mechanical know-how and a decent toolbox. Today, even routine jobs can require manufacturer-specific software to diagnose faults, program replacement modules, or install software updates.

Read: Sure, You Can Replace Ioniq N Brakes, But Only With Hyundai’s $6K Tool Or A $2K Locked Workaround

According to the report, annual subscriptions for factory diagnostic software can run into the thousands of dollars. Tesla charges $3,188 per year, Ford charges around $2,500, and General Motors charges approximately $1,200. Many automakers also offer shorter-term subscriptions, but costs can quickly add up for shops working on multiple brands.

The software itself is only part of the equation. Modern vehicles are loaded with cameras, radar sensors, and advanced driver assistance systems that often require specialized calibration equipment after even relatively minor repairs. Shops must also continually invest in new scan tools and technician training as vehicle technology evolves.

var adpushup = window.adpushup = window.adpushup || {que:[]};

adpushup.que.push(function() {

if (adpushup.config.platform !== "DESKTOP"){

adpushup.triggerAd("bb7964e9-07de-4b06-a83e-ead35079d53c");

} else {

adpushup.triggerAd("9b1169d9-7a89-4971-a77f-1397f7588751");

}

});

Dealers Aren’t Complaining

Photo Ford

Importantly, for automakers and dealers, all of this probably seems like a non-issue . Manufacturers would love more control over who works on the cars they sell. Dealers obviously would too since service is where they make the bulk of their profit. Whether intentional or not, the new hurdle that software presents to independent shops plays directly into the hands of dealers and, by extension, manufacturers.

Also: Trump Says Ford And GM Want A Bill To Restrict Your ‘Right To Repair’ Your Own Car

Washington has taken notice, with lawmakers still arguing over right-to-repair legislation meant to keep repair information and tools available to anyone who needs them. Automakers counter with a 2014 industry agreement that promises independent shops the same repair data and diagnostic tools franchised dealers get. The Alliance for Automotive Innovation restated that commitment as the issue resurfaced, adding that manufacturers have intellectual property and confidential business information to protect.

var adpushup = window.adpushup = window.adpushup || {que:[]};

adpushup.que.push(function() {

if (adpushup.config.platform !== "DESKTOP"){

adpushup.triggerAd("b25ecba7-3bbb-4ea7-a3a8-dbea91695c07");

} else {

adpushup.triggerAd("e46c436a-adeb-4b5e-a2c7-56bc36561c10");

}

});

The Bill Lands On Owners

Repair bills are climbing for consumers regardless. According to U.S. Bureau of Labor Statistics data cited by The Detroit News, vehicle maintenance and repair costs increased 36 percent between May 2022 and May 2026, including a 6 percent increase this year alone. Inflation, supply chain disruptions, tariffs, higher labor costs, and increasingly sophisticated vehicles have all contributed to the trend.

Stephen Rivers / Carscoops

Full text

League of Legends Classic, the new mode which remixes the MOBA by deleting most of the roster and restoring all sorts of old builds and character kits from 2013 and prior, has hit Riot's public test environment.

It's been met with mixed reception since then, in part due to its approach to old visuals—when the PBE version launched, players had modern character models, voice work, and spell effects by default, with "classic skins" unlockable with earned tokens or real money. A thread from user prime_desire with over 6,000 upvotes on the League of Legends subreddit called the mode "League 'not so' Classic," saying "honestly I would be embarrassed to release something like this. Charging for Classic Skins is genuinely wild."

That was reversed within a few days, with Riot's Brian "FeralPony" Feeney addressing feedback concerning the skins and more in a video blog July 16. "Feedback received," he said. "If you're on PBE, you probably already noticed that all classic skins are unlocked for all champions that have one." They've since been made the default option, replacing their respective champions' modern appearances.

Hey everyone. Thank you for your feedback on League Classic. We have a small update we wanted to share on:👗Classic skins💰Gameplay🔧Champion kits pic.twitter.com/CkoW1EJHZj July 17, 2026

He also addressed negative feedback regarding the mode's "greatest hits" approach, clarifying why Riot decided to mix a bunch of old patches together rather than pick a single patch from the game's history and stick to it.

In short, player surveys were all over the place and Riot wants to cast as wide a net as possible. "The answers were almost identical. League was classic the year they started playing, League was best the year after they started, and League was too old before they started." That said, changes will be made as players vote on new patches once the mode hits standard servers.

Other Riot devs have been on social media assuring players the mode is being changed to look even older by default. "It's been fun to basically undo my years of work," said senior VFX artist Sirhaian in a post on X .

2026 games : All the upcoming games

Best PC games : Our all-time favorites

Free PC games : Freebie fest

Best FPS games : Finest gunplay

Best RPGs : Grand adventures

Best co-op games : Better together

Full text

Are you a Google Chrome or an Apple Safari user? These two web browsers are the default options for Android and Apple phones, respectively, and over the years they have utterly dominated the market. In fact, according to Yaguara , over 85% of people are now using one of those two browsers.

Or maybe, like me, you’re one of those rare few people who use Ecosia, or something similar, because you’re keen to do a little bit of good every time you search. Whatever you use, the reality is that AI is taking a stranglehold of all our search experiences.

Homescreen heroes

This is part of a regular series of articles exploring the apps that we couldn't live without. Read them all here .

Search engines are top-loading results with AI summaries, and it’s becoming increasingly difficult to find real websites in the sea of AI and paid-for positions that clutter results. Whether you’re a fan of it or not, one brand that is harnessing AI to deliver a more streamlined search experience is Arc Search .

AI takes center stage

Arc Search boasts three innovative AI features that help users get the information they want quickly. My favorite, mainly because of the way it's implemented, is the ability to get a bullet-point summary of the web page you’re currently visiting.

To access the summary, you perform a pinch gesture on the screen. Arc Search takes just a few seconds to work its AI magic, and while you wait, it keeps your attention by giving you a dancing thumbnail of the webpage. Cute.

When it’s finished thinking, it presents a simple and easy-to-follow breakdown of the key information. The feature is accurate and responsive, but I’d like to see it presented closer to the web page itself rather than taking you out into a separate window.

(Image credit: Future / Paul Hatton) If you’d like to use Arc Search AI to browse the web for you, then ‘Browse for me’ is worth a look. Simply type your search text, select ‘Browse for me ’, and wait for the AI response to be generated. It’s simple to use, and I was glad to see that sources and web links were clearly provided and linked to the relevant AI-generated text.

Beyond these features, you can use Arc Search like any AI engine and ask it specific questions. An extension to this is the ability to lift your phone to your ear and have a conversation with the AI.

A lighter browsing experience

Along with offering a new, AI-centric way to interact with the web, Arc Search takes a drastic approach to de-cluttering the browsing experience. The primary way it does this is with a built-in ad blocker that blocks ads, trackers, pop-ups, and cookie banners. It’s an effective way to limit the often bombarding nature of online ads.

(Image credit: Future / Paul Hatton) To complement the ad block, Arc Search also features a reader mode that strips away any unnecessary page information, converts all text to white, and places it on a black background. It’s a nice way to engage with web pages and a potential solution for anyone with sensory challenges.

Another feature I tried was the translate feature, although it’s not a native Arc Search feature. In fact, it uses Google Translate to power the translation. This didn’t seem to matter, though, as the implementation made it feel like a native part of the app experience.

Other features include auto-archiving old tabs, the syncing of passwords across iCloud Keychain, and an incognito mode. It’s also possible to use Arc Search as a traditional web browser, although Arc Search then simply becomes a container for a third-party browser such as Chrome, Bing, or DuckDuckGo.

(Image credit: Future / Paul Hatton) As you’d expect with most modern tools, Arc Search syncs tabs across all different platforms, including Mac, Windows, and iOS. This means you can start a search journey on your phone before work and pick it up again on your laptop once you arrive in the office. All you have to do is create an Arc account and make sure you’re signed in on all accounts.

AI search, but at what cost?

Arc Search is a solid app that I'm sure will only rise in popularity as more people hear about it. It appeals to our need for speed and convenience, but we should always ask at what cost. For now, I'll continue using Ecosia and prioritizing 'real' results while keeping an eye on whether Arc Search and others can create a more hybrid experience that offers the best of both worlds.

Download Arc Search on iOS and Android .