### Preflight Checklist - [x] I have searched [existing issues](https://github.com/anthropics/claude-code/issues?q=is%3Aissue%20state%3Aopen%20label%3Abug) and this hasn't been reported yet - [x] This is a single bug report (please file separate reports for different bugs) - [x] I am using the latest version of Claude Code ### What's Wrong? # Claude in Chrome side panel shows "refused to connect" — `a.claude.ai` frame blocked by CSP `frame-ancestors` (extension origin missing from allowlist)

[BUG] Claude in Chrome side panel shows "refused to connect" — claude.ai/a.claude.ai frames blocked by CSP frame-ancestors missing the extension origin

Status Open

Maintainer reply None cached

Activity 2 comments · opened Aug 24, 2026

Preflight Checklist

[x] I have searched existing issues and this hasn't been reported yet
[x] This is a single bug report (please file separate reports for different bugs)
[x] I am using the latest version of Claude Code

What's Wrong?

Claude in Chrome side panel shows "refused to connect" — `a.claude.ai` frame blocked by CSP `frame-ancestors` (extension origin missing from allowlist)

Summary

The Claude in Chrome side panel renders only its header; the entire content area shows Chrome's embedded-frame error page ("refused to connect"). The outer panel document loads fine, but the inner application frame served from a.claude.ai is rejected by Chrome because its Content-Security-Policy: frame-ancestors allowlist does not include the extension's own origin. Multiple users at our organization are affected on separate machines.

Environment

OS: Windows [fill in version, e.g. Windows 11 23H2]
Chrome: [fill in from chrome://version]
Extension: Claude in Chrome, official Chrome Web Store install, ID fcoeoabgfenejglbffodgkkbkcdhcgfn, version [fill in from chrome://extensions]
Account: Claude Team/Enterprise org ("Claude-Moldex")
Date observed: multiple users, ongoing as of 2026-08-24

Symptom

Open the side panel on any page → header ("Claude", pin/close controls) renders; the body is a gray pane with the broken-page icon / "refused to connect".
claude.ai works normally in a regular tab on the same machines (signed in, fully functional).
The extension's automation bridge (Cowork / desktop app MCP) works normally — only the panel UI is broken.

Network capture (DevTools on `chrome-extension://fcoeoabgfenejglbffodgkkbkcdhcgfn/sidepanel.html`)

| Request | Status | Notes |
|---|---|---|
| https://claude.ai/new?surface=cic_sidepanel | 200 (32.9 kB) | outer panel document loads fine |
| isolated-segment.html?v=6923243523 (a.claude.ai) | (blocked:other) | 184 kB — full response received, then rejected by Chrome (ERR_BLOCKED_BY_RESPONSE semantics, not a client-side block); initiator vendor-frame-CO_zJn-l.js:1 |

The pattern repeats on each reload (the app appears to retry ~3 times).

Console (verbatim)

Framing 'https://a.claude.ai/' violates the following Content Security Policy directive:
"frame-ancestors https://claude.ai https://*.claude.ai https://anthropic.com https://*.anthropic.com https://*.ant.dev".
The request has been blocked.

Framing 'https://claude.ai/' violates the following Content Security Policy directive:
"frame-ancestors 'self'". The request has been blocked.

Failed to load resource: the server responded with a status of 403 ()
  claude.ai/v1/code/se…XmXi/events   (events endpoint for an active Cowork session, ID redacted)

Independent verification (no browser, no extensions)

Fetched from a clean cloud Linux host via curl (no browser, no extensions, no filtering software, different network) on 2026-08-24:

$ curl -s -o /dev/null -D - "https://a.claude.ai/isolated-segment.html?v=6923243523"
HTTP/2 200
content-security-policy: ... frame-ancestors https://claude.ai https://*.claude.ai
  https://anthropic.com https://*.anthropic.com https://*.ant.dev;
server: cloudflare

The frame-ancestors list is served by the origin, verbatim as quoted in the browser console, with no chrome-extension:// entry — ruling out anything client- or network-side at our org. (The same response's script-src/connect-src reference cdn.segment.com / api.segment.io, i.e. this is the sandboxed Segment analytics frame.)

Analysis

Inside the side panel, the ancestor chain for the application frame is:

https://a.claude.ai/isolated-segment.html
  ← https://claude.ai/new?surface=cic_sidepanel
    ← chrome-extension://fcoeoabgfenejglbffodgkkbkcdhcgfn/sidepanel.html

frame-ancestors requires every ancestor in the chain to match the source list. The a.claude.ai response allowlists only claude.ai, *.claude.ai, anthropic.com, *.anthropic.com, and *.ant.dev — the chrome-extension:// origin is absent, so Chrome blocks the frame in the panel context. The same content loads fine in a normal tab, where the top-level origin is claude.ai.

The outer document (/new?surface=cic_sidepanel) evidently serves a CSP that does permit the extension ancestor (it loads with 200 and renders). Two inner frames are then blocked by the same class of misconfiguration: the a.claude.ai Segment analytics frame (header verified above), and a frame of https://claude.ai/ whose response carries frame-ancestors 'self' — the latter is presumably the one rendering as the visible full-panel "refused to connect" error. The fix appears to be serving frame-ancestors values that include the extension origin (chrome-extension://fcoeoabgfenejglbffodgkkbkcdhcgfn) on responses framed inside the side panel, as is already done for the outer cic_sidepanel document.

The 403 from /v1/code/<session>/events in the panel context may be a knock-on effect of the same broken embedding context and is included as an additional signal.

Ruled out during triage

Machine/profile-specific state: reproduced on a second laptop with a fresh Chrome install and only the Claude extension installed (no other extensions, no filtering software) — identical failure.
Enterprise policy: chrome://policy is clean (only LocalNetworkAccessAllowedForUrls for SharePoint; no URLBlocklist, no cookie policies, no ExtensionSettings, no force-installed extensions).
Ad/privacy blockers: AdGuard extension paused → no change. The blocked request also transfers its full 184 kB body, i.e. it is rejected after the response arrives, which a client-side blocker would not produce.
Sideloaded/modified extension: ID matches the official Chrome Web Store listing.
Network path: claude.ai loads normally top-level on the same machine; no proxy/SWG headers observed.

Repro steps

Install Claude in Chrome from the Web Store, sign in to a paid account.
Open the side panel on any page.
Observe the gray "refused to connect" body.
chrome://extensions → Claude → Inspect views: side panel → Console/Network show the CSP violations above.

Related precedent (different endpoint, same failure class): anthropics/claude-code#21256 ("Login blocked: CSP frame-ancestors directive violation for claude.ai domain").

What Should Happen?

Claude in Chrome side panel shows "refused to connect" — `a.claude.ai` frame blocked by CSP `frame-ancestors` (extension origin missing from allowlist)

Summary

Environment

OS: Windows [fill in version, e.g. Windows 11 23H2]
Chrome: [fill in from chrome://version]
Extension: Claude in Chrome, official Chrome Web Store install, ID fcoeoabgfenejglbffodgkkbkcdhcgfn, version [fill in from chrome://extensions]
Account: Claude Team/Enterprise org ("Claude-Moldex")
Date observed: multiple users, ongoing as of 2026-08-24

Symptom

Open the side panel on any page → header ("Claude", pin/close controls) renders; the body is a gray pane with the broken-page icon / "refused to connect".
claude.ai works normally in a regular tab on the same machines (signed in, fully functional).
The extension's automation bridge (Cowork / desktop app MCP) works normally — only the panel UI is broken.

Network capture (DevTools on `chrome-extension://fcoeoabgfenejglbffodgkkbkcdhcgfn/sidepanel.html`)

The pattern repeats on each reload (the app appears to retry ~3 times).

Console (verbatim)

Framing 'https://a.claude.ai/' violates the following Content Security Policy directive:
"frame-ancestors https://claude.ai https://*.claude.ai https://anthropic.com https://*.anthropic.com https://*.ant.dev".
The request has been blocked.

Framing 'https://claude.ai/' violates the following Content Security Policy directive:
"frame-ancestors 'self'". The request has been blocked.

Failed to load resource: the server responded with a status of 403 ()
  claude.ai/v1/code/se…XmXi/events   (events endpoint for an active Cowork session, ID redacted)

Independent verification (no browser, no extensions)

Fetched from a clean cloud Linux host via curl (no browser, no extensions, no filtering software, different network) on 2026-08-24:

$ curl -s -o /dev/null -D - "https://a.claude.ai/isolated-segment.html?v=6923243523"
HTTP/2 200
content-security-policy: ... frame-ancestors https://claude.ai https://*.claude.ai
  https://anthropic.com https://*.anthropic.com https://*.ant.dev;
server: cloudflare

Analysis

Inside the side panel, the ancestor chain for the application frame is:

https://a.claude.ai/isolated-segment.html
  ← https://claude.ai/new?surface=cic_sidepanel
    ← chrome-extension://fcoeoabgfenejglbffodgkkbkcdhcgfn/sidepanel.html

The 403 from /v1/code/<session>/events in the panel context may be a knock-on effect of the same broken embedding context and is included as an additional signal.

Ruled out during triage

Machine/profile-specific state: reproduced on a second laptop with a fresh Chrome install and only the Claude extension installed (no other extensions, no filtering software) — identical failure.
Enterprise policy: chrome://policy is clean (only LocalNetworkAccessAllowedForUrls for SharePoint; no URLBlocklist, no cookie policies, no ExtensionSettings, no force-installed extensions).
Ad/privacy blockers: AdGuard extension paused → no change. The blocked request also transfers its full 184 kB body, i.e. it is rejected after the response arrives, which a client-side blocker would not produce.
Sideloaded/modified extension: ID matches the official Chrome Web Store listing.
Network path: claude.ai loads normally top-level on the same machine; no proxy/SWG headers observed.

Repro steps

Install Claude in Chrome from the Web Store, sign in to a paid account.
Open the side panel on any page.
Observe the gray "refused to connect" body.
chrome://extensions → Claude → Inspect views: side panel → Console/Network show the CSP violations above.

Related precedent (different endpoint, same failure class): anthropics/claude-code#21256 ("Login blocked: CSP frame-ancestors directive violation for claude.ai domain").

Error Messages/Logs

Steps to Reproduce

Claude in Chrome side panel shows "refused to connect" — `a.claude.ai` frame blocked by CSP `frame-ancestors` (extension origin missing from allowlist)

Summary

Environment

OS: Windows [fill in version, e.g. Windows 11 23H2]
Chrome: [fill in from chrome://version]
Extension: Claude in Chrome, official Chrome Web Store install, ID fcoeoabgfenejglbffodgkkbkcdhcgfn, version [fill in from chrome://extensions]
Account: Claude Team/Enterprise org ("Claude-Moldex")
Date observed: multiple users, ongoing as of 2026-08-24

Symptom

Open the side panel on any page → header ("Claude", pin/close controls) renders; the body is a gray pane with the broken-page icon / "refused to connect".
claude.ai works normally in a regular tab on the same machines (signed in, fully functional).
The extension's automation bridge (Cowork / desktop app MCP) works normally — only the panel UI is broken.

Network capture (DevTools on `chrome-extension://fcoeoabgfenejglbffodgkkbkcdhcgfn/sidepanel.html`)

The pattern repeats on each reload (the app appears to retry ~3 times).

Console (verbatim)

Framing 'https://a.claude.ai/' violates the following Content Security Policy directive:
"frame-ancestors https://claude.ai https://*.claude.ai https://anthropic.com https://*.anthropic.com https://*.ant.dev".
The request has been blocked.

Framing 'https://claude.ai/' violates the following Content Security Policy directive:
"frame-ancestors 'self'". The request has been blocked.

Failed to load resource: the server responded with a status of 403 ()
  claude.ai/v1/code/se…XmXi/events   (events endpoint for an active Cowork session, ID redacted)

Independent verification (no browser, no extensions)

Fetched from a clean cloud Linux host via curl (no browser, no extensions, no filtering software, different network) on 2026-08-24:

$ curl -s -o /dev/null -D - "https://a.claude.ai/isolated-segment.html?v=6923243523"
HTTP/2 200
content-security-policy: ... frame-ancestors https://claude.ai https://*.claude.ai
  https://anthropic.com https://*.anthropic.com https://*.ant.dev;
server: cloudflare

Analysis

Inside the side panel, the ancestor chain for the application frame is:

https://a.claude.ai/isolated-segment.html
  ← https://claude.ai/new?surface=cic_sidepanel
    ← chrome-extension://fcoeoabgfenejglbffodgkkbkcdhcgfn/sidepanel.html

The 403 from /v1/code/<session>/events in the panel context may be a knock-on effect of the same broken embedding context and is included as an additional signal.

Ruled out during triage

Machine/profile-specific state: reproduced on a second laptop with a fresh Chrome install and only the Claude extension installed (no other extensions, no filtering software) — identical failure.
Enterprise policy: chrome://policy is clean (only LocalNetworkAccessAllowedForUrls for SharePoint; no URLBlocklist, no cookie policies, no ExtensionSettings, no force-installed extensions).
Ad/privacy blockers: AdGuard extension paused → no change. The blocked request also transfers its full 184 kB body, i.e. it is rejected after the response arrives, which a client-side blocker would not produce.
Sideloaded/modified extension: ID matches the official Chrome Web Store listing.
Network path: claude.ai loads normally top-level on the same machine; no proxy/SWG headers observed.

Repro steps

Install Claude in Chrome from the Web Store, sign in to a paid account.
Open the side panel on any page.
Observe the gray "refused to connect" body.
chrome://extensions → Claude → Inspect views: side panel → Console/Network show the CSP violations above.

Related precedent (different endpoint, same failure class): anthropics/claude-code#21256 ("Login blocked: CSP frame-ancestors directive violation for claude.ai domain").

Claude Model

None

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

0.9.74

Platform

Anthropic API

Operating System

Windows

Terminal/Shell

VS Code integrated terminal

Additional Information

Claude in Chrome extension v0.9.74 from the Chrome Web Store

View original on GitHub ↗

This issue has 2 comments on GitHub. Read the full discussion on GitHub ↗

[BUG] Claude in Chrome side panel shows "refused to connect" — claude.ai/a.claude.ai frames blocked by CSP frame-ancestors missing the extension origin

Preflight Checklist

What's Wrong?

Claude in Chrome side panel shows "refused to connect" — a.claude.ai frame blocked by CSP frame-ancestors (extension origin missing from allowlist)

Summary

Environment

Symptom

Network capture (DevTools on chrome-extension://fcoeoabgfenejglbffodgkkbkcdhcgfn/sidepanel.html)

Console (verbatim)

Independent verification (no browser, no extensions)

Analysis

Ruled out during triage

Repro steps

What Should Happen?

Claude in Chrome side panel shows "refused to connect" — a.claude.ai frame blocked by CSP frame-ancestors (extension origin missing from allowlist)

Summary

Environment

Symptom

Network capture (DevTools on chrome-extension://fcoeoabgfenejglbffodgkkbkcdhcgfn/sidepanel.html)

Console (verbatim)

Independent verification (no browser, no extensions)

Analysis

Ruled out during triage

Repro steps

Error Messages/Logs

Steps to Reproduce

Claude in Chrome side panel shows "refused to connect" — a.claude.ai frame blocked by CSP frame-ancestors (extension origin missing from allowlist)

Summary

Environment

Symptom

Network capture (DevTools on chrome-extension://fcoeoabgfenejglbffodgkkbkcdhcgfn/sidepanel.html)

Console (verbatim)

Independent verification (no browser, no extensions)

Analysis

Ruled out during triage

Repro steps

Claude Model

Is this a regression?

Last Working Version

Claude Code Version

Platform

Operating System

Terminal/Shell

Additional Information

Related Claude Code issues

Browse by topic

Claude in Chrome side panel shows "refused to connect" — `a.claude.ai` frame blocked by CSP `frame-ancestors` (extension origin missing from allowlist)

Network capture (DevTools on `chrome-extension://fcoeoabgfenejglbffodgkkbkcdhcgfn/sidepanel.html`)

Claude in Chrome side panel shows "refused to connect" — `a.claude.ai` frame blocked by CSP `frame-ancestors` (extension origin missing from allowlist)

Network capture (DevTools on `chrome-extension://fcoeoabgfenejglbffodgkkbkcdhcgfn/sidepanel.html`)

Claude in Chrome side panel shows "refused to connect" — `a.claude.ai` frame blocked by CSP `frame-ancestors` (extension origin missing from allowlist)

Network capture (DevTools on `chrome-extension://fcoeoabgfenejglbffodgkkbkcdhcgfn/sidepanel.html`)