cowork.exponential-systems.net  /  chrome-extension

Claude Chrome Extension — Capability Surface Analysis

Static analysis of deobfuscated extension source  ·  v1.0.40  ·  git hash 386259bb  ·  Extension ID fcoeoabgfenejglbffodgkkbkcdhcgfn
Companion to cowork.exponential-systems.net  ·  independent-verification  ·  2026-04
Methodology Note This analysis is based on deobfuscated source recovered from the extension's bundled JavaScript assets. An analysis control plane (gating all active capabilities to OBSERVE_ONLY mode by default) was overlaid on the source prior to study. The gates are not present in the production extension. The capability surface described below reflects what the production extension can do; the analysis build is what was studied.

Manifest Permissions

Extension ID fcoeoabgfenejglbffodgkkbkcdhcgfn, Manifest v3, version 1.0.40.

debugger
Attach Chrome DevTools Protocol to any tab. Enables full read/write of page state, network traffic, console output, and JavaScript runtime. Operates outside the browser's normal extension sandbox. Persists until explicitly detached.
<all_urls> (host permission)
Content script injection and scripting API access on every URL in every browser. No per-site consent required. Combined with scripting, allows arbitrary JS execution in any page context.
nativeMessaging
Bridge to local binaries outside the browser sandbox. Connects to two registered hosts: com.anthropic.claude_browser_extension (Desktop) and com.anthropic.claude_code_browser_extension (Claude Code). Each runs at user privilege with no isolation.
declarativeNetRequestWithHostAccess
Modify, block, or redirect network requests on any host. Combined with <all_urls>, this applies to all traffic from all tabs.
system.display
Read display configuration: resolution, arrangement, and attached monitor count. Available to the service worker without user interaction.
alarms
Schedule recurring execution at arbitrary intervals. Used by the scheduled task runner to execute Claude-driven browser workflows automatically — daily, weekly, or custom schedules — without user initiation.
scripting, tabs, tabGroups, webNavigation
JS injection into pages, tab enumeration and control, tab group management, navigation event observation.
offscreen, unlimitedStorage, downloads
Off-screen document for GIF/capture processing. No storage quota ceiling. File download API access.

Content Scripts

Three content scripts are injected by the extension. Two run on every URL in every frame.

Script Matches Timing All Frames What it does
content-script.js https://claude.ai/* document_end no Claude.ai integration — session bridge
accessibility-tree.js <all_urls> document_start yes Installs window.__generateAccessibilityTree() into every page and frame before the page's own JavaScript runs. Builds a structural map of all interactive elements: links, buttons, inputs, forms, text content, ARIA roles, and element references via window.__claudeElementMap
agent-visual-indicator.js <all_urls> document_idle no Visual overlay indicating agent activity
Accessibility Tree — Key Detail accessibility-tree.js runs at document_start with all_frames: true. This is the earliest possible injection point — before the DOM is parsed, before the page's scripts load, before any frame-level security checks the page might perform. The injected function remains available for the extension to call at any point during the page lifetime, returning a full structural map of every interactive element along with their current values. This applies to every page in every tab, including banking portals, password managers, authenticated sessions, and any other sensitive context.

CDP Layer (Chrome DevTools Protocol)

The debugger permission is used to attach CDP sessions to tabs. Once attached, the extension can issue any CDP command the browser exposes. Three capability domains are explicitly wired:

Network.enable
Intercepts all network traffic from the attached tab. maxPostDataSize: 65536 — captures the first 64 KB of every POST request body. This includes form submissions, API calls, login credentials, and any other data the page sends to any server.
Runtime.enable
Console output tracking. All console.log, console.error, and exception events from the page's JavaScript are accessible to the extension.
Input.* (cdpInput)
Synthetic keyboard and mouse event injection into any attached tab. Enables the extension to type, click, and navigate programmatically without user action.

CDP attachment is gated in the studied build by shouldAllowDebuggerAttach(tabId). In the production extension there is no equivalent gate — attachment proceeds on any tab the extension chooses to target.

Native Host Bridge

The service worker maintains a persistent connection to local binaries via chrome.runtime.connectNative(). Two hosts are registered:

→com.anthropic.claude_browser_extension — Claude Desktop native host
→com.anthropic.claude_code_browser_extension — Claude Code native host
→stdio length-prefixed JSON → Rust binary (chrome-native-host, ~2.1 MB, outside browser sandbox)
→Unix domain socket → Claude Desktop main process → MCP servers
* Native host runs at user privilege. No browser sandbox applies. The manifest for com.anthropic.claude_browser_extension is written to all Chromium-based browser directories at install time, including browsers not yet installed on the device.

Scheduled Task Runner

The extension includes a complete autonomous task execution engine driven by Chrome's alarms API. Tasks are configured by the user, then executed on schedule without user presence:

1.Chrome alarm fires (daily / weekly / custom interval)
2.Service worker wakes, retrieves task configuration
3.Opens a new browser window to the task URL
4.Delivers the task prompt to the tab via EXECUTE_TASK message
5.Claude executes the full browser automation workflow
6.Segment event fired: claude_chrome.scheduled_task.executed with task_id, task_name, success, execution_type

Workflow Recording

sidepanel-workflow-recording.js (67 KB) implements a workflow capture system. The user performs a sequence of browser actions; the extension records the action sequence and stores it as a replayable shortcut. Replaying the shortcut re-executes the sequence autonomously.

This is documented in the official help center as: "Teach Claude a workflow by recording the steps yourself, and Claude learns to repeat them." The deobfuscated source confirms the recording runs through the same CDP and accessibility-tree surfaces documented above.

Telemetry — Three Vendors

The extension bundles three separate analytics/telemetry vendors. All are disabled in the studied build's analysis control plane; the production extension activates them per feature flags served from api.anthropic.com/api/bootstrap/features/claude_in_chrome.

VendorPurposeBundle size
SentryError tracking and crash reporting417 KB
DatadogPerformance monitoring, session replay250 KB
SegmentBehavioral analytics — user action tracking(in model-selector bundle)

Segment emits events from two namespaces. The full event inventory extracted from the deobfuscated source:

claude_chrome.* — extension-specific behavioral events:

claude_chrome.chat.user_message_sent claude_chrome.chat.usage claude_chrome.chat.session_started claude_chrome.chat.assistant_response_stopped claude_chrome.chat.feedback claude_chrome.chat.tool_called claude_chrome.mcp.tool_called claude_chrome.chat.shortcut_created claude_chrome.chat.shortcut_updated claude_chrome.chat.shortcut_deleted claude_chrome.chat.system_command_executed claude_chrome.scheduled_task.executed claude_chrome.model.changed claude_chrome.permission_mode.changed claude_chrome.permission.prompted claude_chrome.permission.responded claude_chrome.settings.microphone_enabled claude_chrome.extension.update_available claude_chrome.extension_url.reconnect claude_chrome.extension_url.tab_switch claude_chrome.extension_url.unknown_exception

claudeai.* — claude.ai platform events (also present in the extension):

claudeai.session.user_message_sent claudeai.session.response_received claudeai.session.connecting claudeai.session.connected claudeai.session.disconnecting claudeai.session.reconnecting claudeai.session.reconnection_failed claudeai.session.disconnected_due_to_error claudeai.message.edited claudeai.message.user_triggered_retry claudeai.artifacts.execution.error claudeai.code.message.submitted claudeai.code.composer.session_creation_started claudeai.code.environment.created claudeai.code.environment.token_generated claudeai.code.github_app.installation.completed claudeai.yukon_gold.session_created claudeai.cardamom_prompts.prompt_used claudeai.chat.sync_message_loss claudeai.claude_code_nudge.clicked

Architectural Relationship to Cowork

The cowork documentation covers the Windows-side cowork-svc.exe architecture and the sdk-daemon TLS interception inside the Linux VM. The Chrome extension represents a parallel interception surface operating at a different layer on macOS and Windows:

Surface Platform Layer Mechanism Reaches
sdk-daemon MITM Windows/Linux (VM) TLS CA cert installed as trusted root All *.anthropic.com traffic, decrypted
CDP Network.enable Any (Chrome) Browser network DevTools Protocol attachment POST bodies (64 KB) from any attached tab
Accessibility tree Any (Chrome) DOM (pre-script) document_start content script All interactive elements, values, structure on every page
Native host bridge Any (Chromium) OS process chrome.runtime.connectNative Claude Desktop + Claude Code; user-privilege binary outside sandbox

The mechanisms are different at each layer; the endpoint reached — Anthropic API traffic and user browser state — is the same across them.

Provenance

Independent Discovery Timeline — Two Phases Phase 1 — September 28, 2025: Claude.ai's internal Chrome extension infrastructure was first documented through analysis of Claude.ai's webpack source maps (2,302 modules). The following internal utility packages were discovered and catalogued: utility_extension-core, utility_sidepanel-kit, utility_extension-telemetry, utility_extension-auth, utility_context-menu-kit, utility_extension-storage. This analysis was conducted while investigating the <long_conversation_reminder> XML injection mechanism — Anthropic-controlled behavioral guideline injections appearing in every conversation. The discovery session (46c37020) also produced claude_os_statsig_monitor.user.js, a UserScript intercepting Claude.ai's internal Statsig feature flag system in real time. A capability deployment report from this session (2025-09-28T06:23:24Z, Deployment ID: exp_deploy_1759040604619) catalogued 38 capabilities, the last registered being behavioral_optimization: "Real-time adaptation to external influences."

Phase 2 — January 2026: The native messaging manifest installation and multi-browser pre-registration described on this page were independently characterized, including the webRequest interception capability on api.anthropic.com and the Computer Use / MCP bridge architecture.

Note on "public coverage": Anthropic publicly announced Claude for Chrome on August 26, 2025 (research preview to 1,000 Max plan users, status/1960417002469908903). The September 28, 2025 webpack analysis came 32 days after this announcement. What was not disclosed in the public announcement — and what the January 2026 characterization documented — was the native host pre-registration across browsers not yet installed, the webRequest interception on api.anthropic.com, the debugger (CDP) permission, and the silent multi-browser deployment alongside Claude Desktop. Coverage of those specific undisclosed capabilities appeared publicly approximately April 2026, approximately three months after the January 2026 characterization.

The deobfuscated source tree analyzed here (v1.0.40, git hash 386259bb) was recovered from the extension's bundled assets. The analysis control plane overlaid on the source — gating all active capabilities to OBSERVE_ONLY by default — is not present in the production extension and was added by the analyst for safe study.

Deployment without enrollment: The owner of this system was not notified of selection into the August 26, 2025 research preview and did not knowingly opt in to the 1,000-user cohort. The chrome-native-host Rust binary was discovered already present and running on the machine — which is the basis for the Genie clean-room reconstruction documented at /browser-extension. The public announcement framed the preview as deliberate selection of specific users. Silent pre-installation on a machine whose owner had no awareness of enrollment is not consistent with that framing.
cowork.exponential-systems.net · independent-verification · x01-capability-restructuring · chrome-extension · 2026