# Claude in Chrome vs Claude Cowork: what's actually different > Claude in Chrome, Claude Cowork, and Claude Code's Chrome integration are three different products. What each does, what it costs, and two real security incidents. _Markdown version of https://gemini-notebook-hub.online/guides/claude-in-chrome-vs-cowork — for AI and LLM crawlers. Content is identical to the web page._ --- _12 min read · updated 25 Aug 2026_ Anthropic now ships three products with overlapping names and overlapping demos: Claude in Chrome, which drives your browser; Claude Cowork, which manages files on your machine; and Claude Code's own Chrome integration, which reuses the first one for a different purpose entirely. They're genuinely separate products, though Anthropic has quietly started merging two of them. Here's what each one does, what it costs, and two documented security incidents worth knowing about before you grant any of them access to a real account. --- > **Quick answer** > **Claude in Chrome** is a browser extension: Claude reads the page you're on, clicks, types, and navigates, launched from a side panel in Chrome (or Chromium-based browsers, for the version built into Claude Code). **Claude Cowork** is a separate desktop agent that runs in its own environment and manages local files, documents, and folders on your machine, it doesn't drive your browser at all. Both require a paid Claude plan (Pro, Max, Team, or Enterprise); there's no free tier for either. > The two are converging in one specific place worth knowing about: **on Max and Team plans, opening the Claude in Chrome side panel now starts a Cowork session**, per Anthropic's own support documentation. On other plans, or until your admin enables it, the side panel still runs what Anthropic calls the "classic" Claude in Chrome experience. A third, separate thing, Claude Code's Chrome integration, reuses the Claude in Chrome extension as its browser backend but is driven from a terminal or VS Code, not from Chrome itself. The confusion is reasonable. All three launched within roughly a year of each other, all three involve Claude interacting with something outside a chat window, and Anthropic's own naming doesn't do much to keep them apart. This guide traces each one to its own documentation, states what's actually confirmed for each, and covers two real, dated security incidents that are worth reading before you decide which of these, if any, gets access to your browser or your files. ## Claude in Chrome: a browser extension, not an assistant panel Per [Anthropic's own support documentation](https://support.claude.com/en/articles/12012173-get-started-with-claude-in-chrome), Claude in Chrome is a browser extension that lets Claude read, click, and navigate websites alongside you, launched from a side panel inside the browser itself. It can fill forms, compare listings across tabs, follow a multi-step workflow on a site, and read what's rendered on the page the way a person looking at the screen would, rather than only what a URL's raw HTML contains. It requires a **paid Claude plan: Pro, Max, Team, or Enterprise**, there is no free-tier version. It's Chrome (or Chromium-based browser) only, and it has no mobile equivalent: this is a desktop-browser feature, full stop. Installing it grants Claude several real browser permissions, including `debugger`, `scripting`, `tabs`, and `webNavigation`, which is exactly the level of access needed to click and read pages on your behalf, and exactly why Anthropic's own documentation includes a direct warning alongside the setup instructions rather than burying it in a separate policy page. ![Anthropic's official support documentation page for getting started with Claude in Chrome, showing the Cowork-session convergence detail](/blog/claude-in-chrome-vs-cowork-support-doc.png) _Anthropic's "Get started with Claude in Chrome" support page, support.claude.com, August 2026._ Hands-on reports give a clearer sense of where it actually breaks than the feature list does. XDA's review ran a real reward-points-checking task and found the extension worked but hit a concrete bug: a screenshot or region-capture tool captured the full screen instead of the area actually selected, the kind of small failure that matters if you're relying on it for anything precise. TechRadar ran its own real workflow, checking a rewards account balance, and came away describing the experience as convenient but unsettling, precisely because handing an AI agent your logged-in session to a real account is a different trust decision than asking it a question in a chat window. ## Claude Cowork: a separate desktop agent, not a browser feature Claude Cowork is a different product surface entirely, and its own architecture has already changed once. Per [Anthropic's own "Use Claude Cowork safely" support article](https://support.claude.com/en/articles/13364135-use-claude-cowork-safely), Cowork sessions now run in the cloud on Anthropic's servers by default, in an isolated, temporary environment, reaching your local files, browser, and apps through the Claude Desktop app rather than executing directly on your machine. Independent technical write-ups of Cowork's earlier, local-execution design described a full Linux virtual machine with an unprivileged agent user and a separate root-level helper process (`coworkd`) managing shared folders with your actual machine; that local mode still exists as a non-default option, but cloud execution is now what most sessions actually run. Cowork's job either way is local file and document work: organizing folders, drafting and editing documents, and handling multi-file tasks, not reading or acting on live web pages on its own. ## Where the two are actually merging Confirmed directly from Anthropic's own support page: **on Max and Team plans, the Claude in Chrome side panel now runs as a Claude Cowork session**, and Anthropic states this is actively rolling out to Pro plans too. On Enterprise plans, the side panel runs as a Cowork session only once an admin has enabled Cowork in the cloud for that organization; until then, Enterprise accounts get the "classic" Claude in Chrome experience instead. This isn't a hidden detail. Outlets including 9to5Mac and Engadget covered the convergence in mid-August 2026, so treat this section as a clear, sourced synthesis of where the two products stand today rather than an exclusive find. ``` Plan What the Chrome side panel actually runs -------------------------------------------------------------------------------- Max, Team A Claude Cowork session (current) Pro Rolling out to a Cowork session (per Anthropic, in progress) Enterprise Classic Claude in Chrome, unless admin has enabled Cowork in the cloud org-wide, then a Cowork session Source: Anthropic's "Get started with Claude in Chrome" support page, support.claude.com, verified 25 Aug 2026. ``` In practice, this means the honest answer to "is Claude in Chrome different from Claude Cowork" is becoming "it depends which plan you're on," a distinction easy to miss if you only read one product's documentation and not the other's. ## Claude Code's Chrome integration: a third, separate thing Per [Claude Code's own documentation](https://code.claude.com/docs/en/chrome), Claude Code (the terminal-based coding agent) integrates with the Claude in Chrome extension to add browser-automation capability to the CLI or the VS Code extension, triggered with a `--chrome` flag or equivalent. It reuses the same underlying extension as the standalone Claude in Chrome product, but the control surface is completely different: you're driving it from a terminal or an IDE, not from the browser's own side panel. This version has its own separate requirements: it needs a **direct Anthropic API plan**, not access routed through Amazon Bedrock, Google Cloud's Agent Platform, or Microsoft Foundry, and a minimum extension version (**v1.0.36 or later**). It also supports a wider set of Chromium-based browsers, Edge, Brave, Arc, Vivaldi, and Opera, though notably not inside WSL. If you're a developer expecting the same browser automation inside Claude Code that you saw in a Claude in Chrome demo, this is the version you actually get, and its plan requirements are stricter than the standalone extension's. ## All three, side by side ``` Claude in Chrome Claude Cowork Claude Code + Chrome -------------------------------------------------------------------------------------------- What it drives Live browser pages Local files (cloud- Live browser pages run by default) (same extension) Launched from Chrome side panel Cowork app Terminal / VS Code Plan required Pro, Max, Team, Pro, Max, Team, Direct Anthropic API Enterprise Enterprise plan only (no Bedrock/Cloud Agent Platform/Foundry) Browser support Chrome/Chromium n/a (not browser- Chrome, Edge, Brave, based) Arc, Vivaldi, Opera Mobile None None None Source: Anthropic's own support and Claude Code documentation, verified 25 Aug 2026. ``` ## Timeline: how fast this rolled out - **26 Aug 2025:** Claude in Chrome pilots to roughly 1,000 Max-plan users on a waitlist. - **24 Nov 2025:** Opens to all Max subscribers. - **18 Dec 2025:** Extends to Pro, Team, and Enterprise plans. - **23 Jul 2026:** The SharedRoot Cowork vulnerability (below) is disclosed. Cowork's shift toward running sessions on Anthropic's servers by default followed not long after, though Anthropic hasn't stated the two are directly connected. ## What it costs Neither product carries its own separate subscription fee, both ride on your existing paid Claude plan (Pro at $20/month, Max, Team, or Enterprise), and there's no add-on charge the way Microsoft's Copilot Notebooks bills a separate per-seat premium. The real cost is usage, not dollars: agentic browsing and Cowork sessions consume your plan's message/usage limits faster than a normal chat conversation, since every click, page read, and file operation counts as model activity. If you're a heavy user of either feature, expect to hit your plan's usage ceiling sooner than you would chatting normally, not a separate bill. ## The safety picture: two documented incidents, and Anthropic's own numbers This is the part worth reading in full before installing either product, because both have had a real, named, dated security issue, not a hypothetical one, and Anthropic has published its own numbers on how often the underlying risk (a malicious web page trying to hijack the agent) actually succeeds. - **Prompt injection against Claude in Chrome.** At launch, Anthropic's own red-team testing found an unmitigated browser agent followed a hidden malicious instruction embedded in a page **23.6% of the time** across 123 test cases spanning 29 attack scenarios. After Anthropic's initial mitigations, that fell to **11.2%** overall, and to **0%** on a browser-specific challenge subset, per the company's own ["Piloting Claude for Chrome" post](https://claude.com/blog/claude-for-chrome) from August 2025. A newer round of internal adaptive-attacker testing, published in November 2025 against Claude Opus 4.5, put the rate at **1%**, and Anthropic's ["Use Claude in Chrome safely" support article](https://support.claude.com/en/articles/12902428-use-claude-in-chrome-safely) currently states the figure is under **0.08%** against its combined internal testing. These are Anthropic's own published figures, not a third party's estimate, and every version of them agrees on the same honest reading: the risk is real and non-zero even after heavy mitigation, not eliminated. - **ShadowPrompt**, a zero-click prompt-injection technique that used origin-spoofing to trick the extension, was identified and patched in **extension version 1.0.41**. If you installed Claude in Chrome before that patch and haven't updated since, you were running a version with this specific, named vulnerability open. - **SharedRoot**, a Claude Cowork vulnerability disclosed **23 July 2026**, allowed a VM escape via a Linux kernel privilege-escalation path, exposing an estimated **500,000 macOS users** before it was addressed. Anthropic reportedly closed the underlying report without treating it as an actionable fix; Cowork's later shift to running sessions on Anthropic's servers by default happens to close the same gap, though Anthropic hasn't stated the architecture change was made because of this specific disclosure. Anthropic's own guidance, stated plainly in its safety documentation, is not to use Claude in Chrome for banking or other high-stakes financial sites. That's the company's own recommendation, not outside caution layered on top, and it's a reasonable bar to apply more broadly: if a site holds money, health records, or anything else you'd hate to see mishandled, that's not the place to test either of these features for the first time. ## How this compares to Gemini in Chrome Google shipped its own competing feature, [Gemini in Chrome with Auto Browse](/guides/gemini-in-chrome-android), opening it to all US Android users in August 2026. The core pitch is similar, an AI agent that can act inside your browser, but the products differ in reach and integration rather than in the underlying idea: Gemini's version is currently gated to eligible Google AI Pro/Ultra subscribers and limited to US availability, with native ties into Gmail, Drive, and Docs that Claude in Chrome doesn't have since it isn't built around a Workspace-style productivity suite. Claude's strength runs the other direction, toward developer and coding workflows through its Claude Code integration, which Gemini in Chrome has no direct equivalent of. If your daily workflow already lives inside Google Workspace, Gemini's integration will feel more useful; if it lives inside a code editor, Claude's will. ## When not to use either one - **Banking, healthcare, or other sensitive-account logins.** Anthropic's own documentation advises against this directly for Claude in Chrome. - **You're on the free Claude tier.** Neither feature is available without a paid Pro, Max, Team, or Enterprise plan. - **You need it on mobile.** Both are desktop-only; there's no Android or iOS equivalent for either. - **You haven't updated the extension recently.** Given a named, patched vulnerability (ShadowPrompt) already exists in the wild, running an old extension version on purpose has a specific, documented downside, not just a generic "keep software updated" concern. ## People also ask ### Is Claude in Chrome the same thing as Claude Cowork? No, they're separate products, browser automation versus local file management, though on Max and Team plans the Claude in Chrome side panel now actually runs a Cowork session under the hood, per Anthropic's own documentation. On Pro this is still rolling out; on Enterprise it depends on whether an admin has enabled Cowork org-wide. ### Does Claude in Chrome cost extra on top of my Pro or Max plan? No separate fee, but it consumes your plan's usage limits faster than normal chatting, since each click, page read, or navigation counts as model activity. Heavy use means hitting your usage ceiling sooner, not a separate bill. ### Is Claude in Chrome safe to use on any website? Anthropic's own red-team testing found real, non-zero prompt-injection risk even after mitigation, and the company explicitly advises against using it on banking or other high-stakes financial sites. Update the extension regularly; a named vulnerability (ShadowPrompt) was already found and patched in version 1.0.41. ### What's the difference between Claude in Chrome, Claude Cowork, and Claude Code's Chrome integration? Claude in Chrome drives your live browser (click, type, navigate). Claude Cowork manages local files and documents, running the work in an isolated cloud environment by default rather than on your device. Claude Code's Chrome integration reuses the Claude in Chrome extension but is controlled from a terminal or VS Code rather than the browser's side panel, and requires a direct Anthropic API plan rather than Bedrock, Google Cloud's Agent Platform, or Foundry access. ### Does Claude in Chrome or Cowork work on mobile? No. Both are desktop-only features; neither has an Android or iOS equivalent as of this writing. ### Was Claude Cowork ever actually hacked? A specific, disclosed vulnerability called SharedRoot (23 July 2026) allowed a VM escape via a Linux kernel privilege-escalation path, exposing an estimated 500,000 macOS users. Anthropic closed the underlying report without an actionable fix; Cowork's later shift to running sessions on its own servers by default happens to close the same gap, though Anthropic hasn't said the two are connected. ### How does this compare to Gemini in Chrome? Both let an AI agent act inside your browser, but Gemini's version is currently limited to eligible Google AI Pro/Ultra subscribers in the US and integrates natively with Gmail, Drive, and Docs. Claude's advantage runs toward developer workflows through its Claude Code integration, which Gemini in Chrome doesn't have a direct equivalent of.