# Claude in Chrome: Setup and Safety Install both paths, understand the permission that matters, verify it actually works, and know what to do when it stops. Version 1.0, 2026-08-22. Every figure measured or read on that date. Free to copy, fork and reuse. Attribution appreciated, not required. Source article: https://jwatte.com/blog/claude-in-chrome-browser-extension/ --- ## 0. Two products, one name | | Claude in Chrome | Claude Code with Chrome | |---|---|---| | What it is | A browser extension with a side panel | The same extension, driven from a terminal or VS Code | | You talk to it in | The browser | Claude Code | | Good for | Working inside a page you are looking at | Chaining browser actions with code changes | | Needs | A paid Claude plan | The extension, plus Claude Code signed in with `/login` | Both use the same extension. Install it once. --- ## 1. Install ### The extension 1. Chrome Web Store, search for Claude, or go direct to the listing. 2. **Add to Chrome**. 3. Sign in. **A paid plan is required**: Pro, Max, Team or Enterprise. No free tier. 4. Pin it via the puzzle-piece icon. 5. Grant permissions. Read section 2 first. The side panel is available on Max and Team and has been rolling out to Pro. ### Wiring it to Claude Code ```bash claude --chrome ``` First launch shows a one-time dialog about site permissions. After that: ``` /chrome ``` shows status, reconnects, and lets you pick a browser when several are connected. You want **Status: Enabled** and **Extension: Installed**. To skip the flag every session, run `/chrome` and choose "Enabled by default". Trade-off from the documentation: browser tools then load into every session and consume context whether you use them or not. If sessions start feeling heavy, turn it off and use the flag deliberately. In the VS Code extension no flag is needed; Chrome is available whenever the extension is installed. ### If Claude asks to install it for you When Claude needs the browser and the extension is missing, it shows a prompt titled "Claude wants to use your browser", at most once per session, with three choices: **Install extension** (guided, connects in the same session), **Not now**, or **Don't ask again**. You can always set it up later with `/chrome`. If your organisation blocks the `claude-in-chrome` MCP server through managed settings, the prompt never appears. --- ## 2. The permission table | Permission | What it does | |---|---| | `sidePanel` | Lets Claude appear as a side panel | | `scripting` | Lets Claude read text on webpages | | **`debugger`** | **Lets Claude actually control the browser: clicking, typing, screenshots** | | `tabs` | Open, close, switch tabs | | `downloads` | Download files when asked | | `storage`, `tabGroups`, `alarms`, `notifications`, `system.display`, `webNavigation`, `declarativeNetRequestWithHostAccess`, `offscreen`, `nativeMessaging`, `unlimitedStorage` | Supporting | **`debugger` is the product.** It is also the deepest control Chrome grants, which is why Chrome shows a persistent banner while it is in use. That banner is Chrome working correctly, not a warning that something is wrong. The correct response is scoping, not alarm: * **Set site permissions in the extension settings** before you start, rather than approving sites one at a time under time pressure. * **On Team and Enterprise, an administrator can set allowlists and blocklists centrally.** If you are rolling this out to a company, configure that first. * **Use a separate browser profile** for anything sensitive, so the sessions Claude inherits are only the ones you meant. ### Read versus write, in Claude Code plan mode Read-only calls run with no prompt. State-changing calls ask. | No prompt | Prompts | |---|---| | Read the page, get page text, find | Clicks, typing, navigation | | Read console messages, read network requests | Tab and window management | | Take a screenshot | Record a GIF | An otherwise read-only call still prompts when it sets a state-changing flag, such as creating a tab group if empty, clearing the console reader, or saving a screenshot to disk. A batched call runs without a prompt only when **every** action inside it is read-only. --- ## 3. Verify it, do not assume In Claude Code, `/chrome` gives you the status panel. A connection check should return your browser with a device id, its platform, and whether it is local. Mine returned a single local Windows browser in under a second. Two things worth checking on day one: * **Which browser it picked.** If more than one is connected, Claude asks, and it remembers your choice even when another connects later. Change it with `/chrome` then "Select browser". * **That the tab group appears.** Claude collects the tabs it opens into a Chrome tab group tied to the session. If you never see one, the connection is not what you think it is. ### What happens to those tabs * `/clear` closes the group, open pages included, unless work that survives the clear is running. * Switching sessions, exiting, or clearing while surviving work runs: the group closes only if it holds nothing but empty new tabs, so pages you may still be reading stay open. --- ## 4. Requirements that will stop you * Extension **version 1.0.36 or higher** for the Claude Code integration. * A **direct Anthropic plan**: Pro, Max, Team, Enterprise. * **Signed in with `/login`.** An API key or a long-lived setup token disables the integration even with `--chrome`, because the extension cannot authenticate with those credentials. * **Not available** through Amazon Bedrock, Google Cloud's Agent Platform, or Microsoft Foundry. You need a separate claude.ai account. * **Not supported in WSL.** Run Claude Code on the Windows side where Chrome lives. * **No graphical browser, no integration.** A server with no desktop cannot run this. Neither can most containers. Browsers: Chrome and Edge are supported. Claude Code also detects the extension and connects in other Chromium browsers including Brave, Arc, Vivaldi and Opera. --- ## 5. Safety, in the vendor's own words Anthropic's description: Claude in Chrome "is enhanced with our safety classifiers but is still risky." **The threat is prompt injection.** Instructions hidden in a page, an email or a document that try to redirect the agent. Their own example is an innocuous-looking to-do list containing invisible text telling Claude to retrieve bank statements and share them. **Their published figure:** "Our current configuration reduces attack success rates to less than 0.08% against our internal testing that combines known effective attack techniques." Immediately followed by: "The risk is not zero. Novel attacks may emerge that our evaluations didn't cover." Both halves matter. That is a strong result against a hard problem, from testing the vendor ran on itself, against an attacker who gets unlimited attempts. ### Refused outright * Stock trading and investment transactions * Bypassing CAPTCHAs * Inputting sensitive data * Gathering or scraping facial images Whole site categories are blocked, including adult content and pirated material. ### The tell **If Claude suddenly starts discussing unrelated topics, visiting unexpected websites, or asking for sensitive information, stop the task.** That is what a successful injection looks like from your side of the screen. It is the single most useful sentence in the documentation. ### Approval modes The default is **Automatically approve**, where Claude reviews each action and pauses when something needs you. **Manually approve** asks about everything. Use manual for your first week, and permanently for anything touching money, customers, or records you cannot restore. ### House rules worth adopting 1. Never run it on a shared machine account. It inherits every logged-in session. 2. Point it at staging before production, always. 3. Put "do not send", "do not submit" or "do not publish" in the prompt when you mean it. Then check anyway. 4. Review any recording before sharing. A GIF captures everything visible, including account details on logged-in pages. 5. Treat page content as data, never as instructions, and expect the agent to do the same. --- ## 6. Troubleshooting ### Extension not detected 1. Confirm it is installed and enabled at `chrome://extensions` 2. `claude --version` 3. Confirm Chrome is running 4. `/chrome` then "Reconnect extension" 5. Restart both Claude Code and Chrome **The first-install gotcha:** Claude Code writes a native messaging host configuration file, and Chrome only reads it at startup. If the extension is not detected on the first attempt, restart Chrome. Claude Code opens the connect-the-extension tab only on that first install. It will not reopen it later, for example after switching builds or config directories. ### Where the host configuration file lives Chrome: * macOS: `~/Library/Application Support/Google/Chrome/NativeMessagingHosts/com.anthropic.claude_code_browser_extension.json` * Linux: `~/.config/google-chrome/NativeMessagingHosts/com.anthropic.claude_code_browser_extension.json` * Windows: registry, `HKCU\Software\Google\Chrome\NativeMessagingHosts\` Edge: * macOS: `~/Library/Application Support/Microsoft Edge/NativeMessagingHosts/com.anthropic.claude_code_browser_extension.json` * Linux: `~/.config/microsoft-edge/NativeMessagingHosts/com.anthropic.claude_code_browser_extension.json` * Windows: registry, `HKCU\Software\Microsoft\Edge\NativeMessagingHosts\` Other Chromium browsers use the same filename under their own configuration directory, and their own registry key on Windows. ### Browser stops responding 1. **Check for a JavaScript dialog.** An alert, confirm or prompt blocks browser events entirely and the extension stops receiving commands. Dismiss it by hand, then tell Claude to continue. This is the most common cause and the least obvious. 2. Ask Claude to create a new tab and retry. 3. Disable and re-enable the extension at `chrome://extensions`. ### Connection drops in a long session The extension's service worker goes idle. `/chrome`, then "Reconnect extension". ### Windows specifics * **Named pipe conflicts (EADDRINUSE)**: restart Claude Code, and close other Claude Code sessions using Chrome. * **Native messaging host crash on startup**: reinstall Claude Code to regenerate the config. ### Error messages | Error | Cause | Fix | |---|---|---| | Browser extension is not connected | Native messaging host cannot reach the extension | Restart Chrome and Claude Code, then `/chrome` | | Extension shows "Not detected" | Not installed or disabled | Install or enable at `chrome://extensions` | | No tab available | Claude acted before a tab was ready | Ask for a new tab and retry | | Receiving end does not exist | Service worker went idle | `/chrome`, "Reconnect extension" | --- ## 7. Upload limits Claude can attach local files to upload fields. Three restrictions: * **Permissions:** it can only upload a file the session may read. A permission rule denying `Read` on a file also blocks uploading it. * **Size:** 10 MB total per upload. * **Hard links:** it refuses files with multiple hard links, which is common inside `node_modules`. Copy the file and upload the copy. --- Companion file at https://jwatte.com/downloads/ * `claude-in-chrome-playbooks.md` : copy-paste prompts for website work, messaging campaigns and everyday tasks Written by J.A. Watte. https://jwatte.com