Table of Contents
Browser extensions are supposed to enhance our online experience, but what happens when these familiar tools turn against us? Recently, about twenty Chrome and Edge extensions, once harmless, received malicious code during an update, thus turning thousands of installations into a potential threat for users. Discover how these extensions became attack vectors and the precautions to take to protect your data.
Key Takeaways
You are browsing the Internet peacefully, with confidence, thanks to your favorite extensions. They help you copy text, translate pages, or manage your passwords. Yet, one day, these same extensions could become your worst enemies. Without you knowing, an innocuous update can turn these tools into formidable weapons, capable of stealing your personal and financial data. This is exactly what happened to thousands of Chrome and Edge users.
According to Socket, a company specializing in computer security, 19 Chrome and Edge extensions were identified as being compromised by malicious code. Initially malware-free, these extensions were modified by a simple update. Just one extension, “Enable Right Click & Copy — Smart Unlock + OCR,” had about 80,000 installations in total, spread between Chrome and Edge.
This process is not new. In 2025, a similar campaign, dubbed ShadyPanda, used a comparable method to gain users’ trust before introducing malicious features. This technique allows attackers to leverage an existing user base to launch their offensives.
Once the extension was compromised, it established an encrypted connection with the attackers’ servers, allowing the transfer of JavaScript modules. Researchers identified 16 different modules, all aimed at data theft. These modules could manipulate login buttons, display fake financial service pages, or even capture browsing history.
Attackers went as far as modifying the viewed pages by neutralizing the Content Security Policy (CSP), an important web security measure. This allowed them to inject their own malicious code and push users to execute dangerous commands.
For affected individuals, it is imperative to immediately remove these extensions from their browser. However, this may not be enough to eliminate all threats. Users should also change their passwords and close active sessions, as the malware could steal session tokens.
For those using cryptocurrency wallets, the situation is even more delicate. If a recovery phrase was entered during the period when the extension was active, it should be considered compromised. It is recommended to create a new wallet with a new recovery phrase and transfer the remaining funds.
Microsoft has intensified its efforts to secure its Edge browser against the growing threat of malicious extensions. Improvements have been made to analyze and verify extension updates, thus reducing the risk of introducing malicious code.
The company also encourages developers to submit their extensions to thorough security testing before publishing them on the Microsoft Store. Continuous verification is essential to ensure that extensions remain safe for users.
Web browser security is a major issue for tech companies, especially as threats become increasingly sophisticated. Companies like Google and Mozilla are constantly working to improve their security protocols to protect users against attacks.
Extensions are often considered the weak link in the browser security chain. Their frequent updates and ability to access sensitive data make them prime targets for cybercriminals. Collaboration between cybersecurity companies and developers is crucial to strengthen extension security.
What should I do if I installed a compromised extension?
It is recommended to immediately uninstall the compromised extension, change all your passwords, and close all active sessions to limit the risk of compromise.
How do attackers introduce malicious code into an extension?
Attackers can buy legitimate extensions or create new extensions that seem harmless. They then wait to have a sufficient user base to introduce malicious code via an update.
What security measures can I take to protect my cryptocurrency wallets?
Use hardware wallets when possible, and regularly check the permissions granted to your digital wallets. Change your recovery phrase if you think it has been compromised.
Are Chrome and Edge extensions still safe to use?
While the majority of extensions are safe, it is important to remain vigilant. Always download extensions from reliable sources, read user reviews, and regularly check the permissions they require.