[BUG] claude.exe attempted to access Firefox cookie database (blocked by Norton)

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Norton (Browser Data Protection) flagged and blocked claude.exe — the process for the Claude Code VS Code extension, running from C:\Users\<user>\.vscode\extensions\anthropic.claude-code-...\ — attempting to access the Firefox cookie database at C:\Users\<user>\AppData\Roaming\Mozilla\Firefox\Profiles\...\.

This happened during a normal Claude Code coding session with no browser automation, WebFetch, WebSearch, or any browser-related tool calls in use at the time. There is no documented feature of Claude Code (per code.claude.com/docs/en/security) that reads or needs browser cookies.

Norton logged two events ~6 seconds apart:

1. "claude.exe prevented from accessing cookies" — Detected/High severity, Action taken: Cookie access prevented
2. "claude.exe was added to app permission list as allowed for Browser Data Protection" — Info

I'd like to understand why the extension process is attempting to read Firefox's cookie store, since it isn't part of any documented functionality.

<img width="924" height="592" alt="Image" src="https://github.com/user-attachments/assets/4003b7be-ebd6-4243-94b5-e039bcaf5bb9" />

<img width="924" height="592" alt="Image" src="https://github.com/user-attachments/assets/7fbe2bbc-3256-4349-8b0d-4868913a88b0" />

What Should Happen?

claude.exe should not attempt to read or access any browser's cookie database (Firefox or otherwise) during normal coding sessions, unless it's part of an explicit, user-initiated, documented feature (e.g. an opt-in browser-integration/automation feature) — and if such a feature exists, it should be clearly documented and never triggered silently in the background.

Error Messages/Logs

Details:
Developers: Anthropic, PBC
Version: 2.1.261.0
Identified: 9/5/26, 2:29 PM
Last Used: 9/17/26, 2:48 PM
Startup Item: No
____________________________
Origin -> Location: local://*PID 8968

Steps to Reproduce

I do not know. I was having Claude Code, in VS Code, track down why a script was not functioning correctly, and during those processes, which Claude Code confirmed it did not initiate any such action that would request reading my Firefox Cookies, I got a Norton popup (apparently from the second attempt, as it automatically blocked the first (see screenshots)) that mentioned that Claude wanted to read these files, and because I already had Claude doing its thing, I opted to click "Accept." After discussing this with Claude Code, I went back into Norton 365 for Gamers, and changed that to "Blocked." I have no idea why the official VS Code extension would have wanted access to these files.

Claude Model

Other

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

2.1.238

Platform

Other

Operating System

Windows

Terminal/Shell

VS Code integrated terminal

Additional Information

_No response_