Two unpatched Claude for Chrome flaws let rogue extensions forge clicks that access Gmail, Docs, and Calendar data.