Claude in Chrome: The Most Underrated Claude Feature

Most people meet Claude through a chat box. You paste something in, you get something back, you copy it somewhere else. Claude in Chrome removes the copying. The extension puts Claude in a side panel that can see the page you are on and act on it: clicking links, typing text, navigating between pages and filling out forms, using the logins you are already signed in with.

That last clause is the whole point, and it is why this is a different category of tool from a connector. A connector needs the other side to expose an API. The browser needs nothing. If you can click it, Claude can click it. Anthropic's own product page frames it as "a helping hand across all your tabs" and, more usefully, as the way to reach "internal dashboards, legacy systems, and vendor portals" that will never have an integration written for them.

The extension is published by Anthropic, currently at version 1.0.85, updated 7 August 2026, weighing 6.19 MiB. It is Chrome only. Not Edge, not Brave, not Arc, not mobile.

On 12 August 2026 Anthropic shipped the change that turns this from a convenience into infrastructure. The side panel is no longer a separate, throwaway chat. It is now a full Claude Cowork session.

Three things follow from that, and each one fixes a real complaint:

• Conversations persist. They save to your history like any other Claude conversation, rather than evaporating with the tab. Anthropic's framing is that sessions now "live with your account rather than a single device".
• Skills, plugins and connectors work in the browser for the first time, with no extra setup. If you have built a skill, it is available in the side panel.
• Work moves between devices. A task begun in a browser tab can be finished in the Claude desktop, web or mobile apps.

Availability is staged: Max and Team from 12 August 2026, with Pro rolling out over the following weeks. Enterprise is the exception - Cowork in the cloud has to be enabled by an admin, and until it is, those users get the classic side panel. If you preferred the old behaviour you can revert from the three-dot menu with "Switch back to classic", which matters more than it sounds, because workflow recording only exists in the classic panel.

Anthropic's worked example is the clearest way to understand why persistence matters. You are building a budget spreadsheet and need invoices from several vendor portals. Claude in Chrome opens the tabs, reads each invoice, collects amounts and dates, and builds the spreadsheet. Then you pick the same session up in the desktop app to add local files or import last quarter's budget.

The division of labour is the useful bit. The browser is where the data is trapped; the desktop is where your files are. Previously those were two conversations and a manual handover. Now they are one session. Anthropic's other suggested pairings are the same shape: Claude in Chrome pulls metrics from an analytics dashboard, and Cowork turns them into a spreadsheet, a deck or a report.

Every AI integration story of the last two years has been about APIs and connectors, and connectors are genuinely good. But they only ever cover the head of the distribution: Gmail, Drive, Slack, GitHub, Salesforce. The software most people actually lose their afternoons to is in the tail - the council planning portal, the freight forwarder's tracking page, the 2011 expenses system your finance team refuses to replace, the supplier extranet with one login per supplier.

Nobody is going to write an MCP server for those. There is no commercial reason to. The browser is the only universal interface they share, which makes a browser-driving agent the only realistic way to automate them. That is the argument for Claude in Chrome being underrated: it is the single Claude surface whose addressable area is "all software with a web interface" rather than "software someone chose to integrate". It is the same bet the rest of the industry is making, as our guide to AI browser automation agents and our look at Google's agentic browser push both set out.

It is also the reason the feature is easy to miss. It does not demo well. Nobody makes a viral clip of an agent filling in a vendor portal. But if your week contains four hours of moving numbers between systems that will never talk to each other, this is the Claude feature that touches it.

From Anthropic's own documentation and store listing, the current capability set:

• Read, click, type and navigate on the page you are on, plus take screenshots.
• Multi-tab workflows. Claude groups its tabs into a separate workspace and can work across them at once, in the background, while you carry on in another tab.
• Scheduled recurring tasks - daily, weekly, monthly or annually - so a browser job can run without you starting it.
• Workflow recording (classic panel only): perform the steps once, and Claude learns to repeat them.
• Console and network access for debugging: Claude can read browser errors, network requests and DOM state.
• Claude Code integration: build in Claude Code, deploy to a URL, then have Claude open it in the browser to test and verify the change.
• Built-in knowledge of common platforms including Slack, Gmail, Google Calendar, Google Docs and GitHub.
• 1Password integration (beta, macOS): rather than stalling at a login wall, Claude can request credentials from 1Password, which you approve with biometrics.

One important boundary: tasks that need local files or your actual computer require the Claude desktop app to be open. The extension drives the browser, not the machine.

This is where people should slow down, because the permission list is broad and Anthropic publishes it in full. The extension requests, among others:

• debugger - to control the browser: clicking, typing, screenshots. This is the powerful one.
• scripting - to read webpage text.
• tabs and tabGroups - to open, close and switch tabs, and keep its own separate.
• downloads - to download files from websites.
• alarms - to run scheduled tasks.
• webNavigation - to detect high-risk sites.
• system.display - to work out screen size for accurate clicking.
• nativeMessaging - for integration with Claude Desktop and Claude Code.

The Chrome Web Store listing states plainly that the extension handles personally identifiable information, communications, location data, web history, user activity and website content. That is not a scandal - it is the honest description of what a browser agent must touch to work - but it is a genuine decision, not a formality. Anthropic also confirms that zero data retention is not supported for Claude in Chrome, which is a hard blocker for some regulated environments.

Anthropic has been unusually forthcoming about the risk here, and the numbers deserve to be read carefully rather than quoted as reassurance.

The central threat is prompt injection: text on a webpage, or in an email Claude reads, that issues instructions Claude then follows as though they came from you. Anthropic's red-team suite of 123 test cases across 29 attack scenarios found a 23.6% attack success rate for browser use with no mitigations, falling to 11.2% with mitigations applied. For four browser-specific attack types - things like hidden DOM form fields and URL-based text injection - the rate fell from 35.7% to 0%.

Two honest observations. First, 11.2% is not zero. Roughly one in nine attacks in that suite still worked. Anthropic's own documentation still says the extension "is enhanced with our safety classifiers but is still risky", and that phrasing has not softened.

Second, and less widely noticed: the chart is labelled Sonnet 4. These are pilot-era numbers from 2025. The models driving the extension today are a generation beyond that, the mitigations have moved on, and Anthropic has not published a refreshed version of this evaluation. The direction of travel is almost certainly good, but anyone citing "11.2%" as the current risk level is quoting a year-old measurement of a different model.

The concrete example Anthropic gives is worth internalising because it is so mundane: an email claiming to be from the security team, asking for messages to be deleted for "mailbox hygiene". Before the defences, Claude deleted them without asking. After, it identified the message as a phishing attempt.

There is one newer defence worth knowing about, introduced with the Cowork side panel: before a consequential action such as submitting a form or downloading a file, a separate check reviews the action against what you originally asked for and blocks anything that does not match. That is a structurally better defence than classifier-only filtering, because it compares intent to action rather than trying to spot malicious text.

The default mode is "Automatically approve": Claude works continuously, reviews its own actions for safety and pauses to ask when it hits something sensitive. It asks before high-risk actions such as publishing, purchasing or sharing personal data, and a Stop Claude control stays visible while it is working. Site-level permissions can be granted and revoked at any time in Settings.

Some categories are blocked outright by default, regardless of your settings: financial services, banking, investment platforms, cryptocurrency exchanges, adult content and pirated material.

For organisations, the defaults differ in a way worth knowing: Team has the extension enabled by default; Enterprise has it disabled by default and an admin must turn it on under Organization Settings. Admins get both allowlists and blocklists, and Anthropic's own guidance is to "start with a restrictive allowlist, especially during initial rollout". Access can be granted through role-based permissions independently of other Claude capabilities, and traffic routes through the standard claude.ai and api.anthropic.com endpoints.

It would be dishonest to write "underrated" without addressing the rating. Claude in Chrome sits at roughly 2.8 out of 5 from about 1,500 reviews, against 13 million users. That is a review rate of about one in ten thousand - a sample composed almost entirely of people motivated enough by a problem to go and write about it.

The structural causes are not mysterious, and most are not really software defects:

• It requires a paid plan. A free-tier user installs it, cannot sign in, and leaves one star. The store listing does not gate the install.
• It is Chrome-only. Edge, Brave and Arc users install it and find it unsupported.
• It eats usage limits. Anthropic states directly that browser interactions are more compute-intensive than regular chats and consume more of your allowance, especially in automatically-approve mode on long tasks. People who did not expect that feel misled.
• It fails visibly. A chat that gives a mediocre answer disappoints quietly; an agent that clicks the wrong button on a JavaScript-heavy page fails in a way you watch happen.

None of that makes the rating wrong, exactly. It makes it a measure of expectation mismatch rather than of capability. Judge the tool by what it does when it is set up correctly on a task it suits, and it is one of the strongest things Anthropic ships.

• Chrome only. No other Chromium browser, no mobile.
• Paid plans only - Pro, Max, Team or Enterprise; Team and Enterprise users may additionally need admin authorisation.
• Heavier on usage limits than chat, and limits are shared across Claude, Claude Code and Chrome.
• JavaScript-heavy sites can defeat page reading, and other extensions can interfere with its interactions.
• Workflow recording is classic-panel only, so upgrading to the Cowork panel loses it.
• No zero data retention support, which rules it out for some regulated deployments.
• Too many open tabs degrade performance; Anthropic recommends splitting complex tasks.
• Prompt injection remains an unsolved problem, not a mitigated one.

1. Open Google Chrome specifically, and install the extension from the Chrome Web Store.
2. Sign in with your Claude account. You need an active paid plan.
3. Pin it: click the puzzle-piece icon in the toolbar, then the thumbtack next to "Claude".
4. Grant the permissions it asks for, and set site access to match your comfort level rather than accepting the default everywhere.
5. If you are on Team or Enterprise and cannot sign in, your admin has not enabled it yet.

A practical first task: pick something read-only and multi-tab, like summarising five open articles or pulling figures out of a dashboard, before you let it fill in a form. You learn its failure modes far more cheaply that way.

Install it today if your work involves systems with no API - vendor portals, internal dashboards, legacy admin consoles, supplier extranets - or if you routinely move data between a browser and a spreadsheet. This is the case the tool was built for, and the August update makes it materially better by letting the browser half and the file half of a job live in one session. Developers should also look at the Claude Code loop: build, deploy to a URL, then have Claude open and verify it with console access.

Approach carefully if you handle regulated or highly sensitive data. The permission surface is broad, zero data retention is unavailable, and prompt injection is a live risk with a published non-zero success rate. Start with a restrictive allowlist, exactly as Anthropic recommends to admins.

Skip it if you are on the free tier, do not use Chrome, or your work is mostly writing and reasoning rather than clicking. For those tasks the ordinary Claude apps are cheaper on usage and just as good.

Claude in Chrome is underrated in the literal sense: 13 million installs, a 2.8-star average, and a capability set that no connector strategy can replicate. The August 2026 change - a real Cowork session in the side panel, with persistent history, working skills and connectors, and handoff to desktop and mobile - is the update that turns it from a novelty into the piece of Claude that reaches the software everything else ignores.

It is not the feature to be casual about. The permissions are real, the injection risk is real and quantified, and the headline safety numbers you will see quoted are from a 2025 pilot on an older model. Set the site permissions deliberately, keep the allowlist tight, watch it on its first few runs, and give it the jobs that involve no API and too many tabs. On those, nothing else Anthropic ships comes close.