chrome.i18n in browser extensions: one build, every language
A hands-on Chrome extension i18n tutorial: localize an MV3 build with chrome.i18n and _locales — UI, store listing and RTL. Full runnable code, ~30 minutes.
Maxim Kosterin
18 min read
Extenshi.io Blog
Insights on browser extension development, security best practices, analytics, and the extension ecosystem.
Act on the current page from Chrome's address bar: omnibox + activeTab
An MV3 tutorial: accept an omnibox suggestion, spend the activeTab grant, and highlight or count words on the current page. Runnable code, no install warnings.
Maxim Kosterin
16 min read
The `clipboardRead` permission explained: what an extension sees when you copy and paste
The clipboardRead permission lets an extension read your clipboard with no prompt and no click. Here's what it allows — and the trick that needs no permission.
Maxim Kosterin
9 min read
Omnibox keywords in Chrome extensions: a command palette for zero permissions
Build a Chrome extension command palette on the omnibox API — a keyword in the address bar, live suggestions, no permission warning. Full MV3 code, ~25 min.
Maxim Kosterin
17 min read
The click nobody made: how to check which extensions can drive your AI assistant
Researchers say a rogue extension can fake a click and make Claude for Chrome read your Gmail. How extension-to-extension attacks work, and how to check yours.
Maxim Kosterin
9 min read
Read, write and watch cookies from an MV3 extension
Build a Chrome extension that lists, edits and watches the current site's cookies with chrome.cookies — full MV3 code and the empty-array trap, ~25 min.
Maxim Kosterin
18 min read
chrome.privacy in browser extensions: build a panel that admits what it can't change
Most privacy extensions render toggles they can't enforce. Build an MV3 chrome.privacy panel that reads levelOfControl before it draws a switch — full code.
Maxim Kosterin
20 min read
Record the current tab from an MV3 extension: tabCapture and offscreen documents
A service worker can't hold a MediaStream. Build a Chrome extension that records the current tab's video and audio with chrome.tabCapture — full code, ~30 min.
Maxim Kosterin
16 min read
The `privacy` permission explained: what an extension can change in your browser's own settings
The privacy permission lets an extension flip Chrome's own switches — Safe Browsing, autofill, WebRTC, cookies. Here's what it changes and how to check yours.
Maxim Kosterin
8 min read
What it really takes to publish a browser extension
How long does it take to publish a Chrome extension? Review timelines, rejection reasons, and the hidden work before your listing goes live in 3 stores.
Maxim Kosterin
35 min read
2FA authenticator extensions reviewed: where your TOTP seeds actually live
2FA browser extensions compared: where Authenticator, 2FAS and password-manager TOTP keep your seeds — and how the fake authenticator clones steal them.
Maxim Kosterin
10 min read
Malware that arrives in the update, not the install: how to check your extensions
A Chrome extension pulled in January is back — and shipped its payload two weeks after a clean release. How update-time malware works, and how to check yours.
Maxim Kosterin
9 min read
Extension Pulse, week of August 24: CWS API V1 dies October 15, and Chrome is giving you the Public Suffix List
CWS API V1 dies October 15. Chrome 154 adds chrome.publicSuffix. Edge MV2 and Firefox's two-week train are background.
Maxim Kosterin
4 min read
chrome.management in browser extensions: build a permission audit popup
A hands-on Manifest V3 tutorial: use the chrome.management API and Chrome's own permission warnings to audit every extension installed. Full runnable code.
Maxim Kosterin
16 min read
Cookie extensions reviewed: Cookie-Editor, Cookie AutoDelete & the banner blockers
Cookie extensions touch your session tokens and every site you visit. I compared Cookie-Editor, Cookie AutoDelete and the banner blockers on who owns them.
Maxim Kosterin
10 min read
Content scripts in single-page apps: how to survive a route change in MV3
Your content script runs once on YouTube and never again. Fix Chrome extension SPA navigation with webNavigation — or without a new permission. Full MV3 code.
Maxim Kosterin
15 min read
Extension Pulse, week of August 17: Edge starts killing MV2, Firefox goes fortnightly
Edge starts phasing out MV2. Firefox 155 goes fortnightly. Chrome 153 binds protocol handlers to the extension lifetime.
Maxim Kosterin
4 min read
737 fake VPN extensions: how to check yours isn't a traffic relay
Socket found 737 fake VPN extensions routing Chrome browser traffic through one operator's SOCKS5 proxies. Here's how to check yours and reset the damage.
Maxim Kosterin
9 min read
Runtime script injection in Chrome extensions: ISOLATED vs MAIN world
chrome.scripting.executeScript end to end: inject on click with activeTab, pass args safely, and choose ISOLATED or MAIN world. Full MV3 code, ~25 min.
Maxim Kosterin
22 min read
New tab overrides explained: what an extension that replaces your new tab can really see
Replacing your new tab page takes no permission at all. Here's what a new tab override extension can really see, when it's fine, and how to check yours.
Maxim Kosterin
9 min read
Text-to-speech extensions reviewed: Speechify, NaturalReader & Read Aloud
I compared three text-to-speech extensions on one question: does the text on your screen stay on your device, or does someone else's server read it first?
Maxim Kosterin
11 min read
Optional permissions in Chrome extensions: ask at the click, not at install
Chrome extension optional permissions, end to end: install with no warning, then request topSites and a single host at runtime. Full MV3 code, ~25 minutes.
Maxim Kosterin
22 min read
Edgecution: an extension escaped the browser sandbox — how to check what yours can reach
Edgecution abused native messaging to run a Python backdoor outside Edge's sandbox — from a headless browser you'd never see. How to check your own machine.
Maxim Kosterin
11 min read
Extension Pulse, week of August 10: Firefox finally ships `sandbox`, ten years late
Firefox 154 ships the sandbox manifest key. Chrome 153 blocks user scripts from privileged renderers and asks you to reload after site-access changes.
Maxim Kosterin
3 min read
Mozilla wants AI agents to inherit the extension permission model — I counted what that model looks like at scale
Mozilla's W3C proposal puts AI agent permissions on the browser's extension model. I counted that model at scale: 300,503 extensions, 12,277 already pulled.
Maxim Kosterin
7 min read
AI agents just hacked their way out of the lab. Here's why solo devs should care
OpenAI's Black Hat 2026 talk showed autonomous AI agents coordinating attacks and breaching Hugging Face — the security debt they walked through is yours too.
Maxim Kosterin
11 min read
Blocking requests in a Chrome extension: a hands-on declarativeNetRequest tutorial
Build a Manifest V3 Chrome extension that blocks trackers and strips tracking parameters with declarativeNetRequest — full runnable code, ~30 minutes.
Maxim Kosterin
19 min read
The `downloads` permission explained: what extensions can really do with your files
The downloads permission lets an extension read every file you've downloaded, write new ones, and hide the download UI. Here's what it allows and how to check.
Maxim Kosterin
9 min read
PDF extensions reviewed: Adobe Acrobat, Smallpdf, iLovePDF & Xodo compared
I compared four PDF extensions on permissions and where your documents go. Which upload your files, which stay local, and what the Adobe Acrobat flaw exposed.
Maxim Kosterin
13 min read
Offscreen documents in Chrome extensions: how to use the DOM from an MV3 service worker
MV3 service workers have no DOM. Build a Chrome extension that parses HTML and writes to the clipboard from an offscreen document — runnable code, ~25 min.
Maxim Kosterin
19 min read
Extension Pulse, week of August 3: AMO will now try to build your Firefox add-on from source
AMO now builds Firefox add-ons from source. Chrome 152 beta brings a badge cap and a tighter browser namespace.
Maxim Kosterin
4 min read
chrome.alarms in Manifest V3: background jobs that outlive the service worker
MV3 kills setInterval. Build a Chrome extension background job with chrome.alarms that survives service worker termination — full runnable code, ~20 min.
Maxim Kosterin
16 min read
The `debugger` permission explained: what browser extensions can really do with DevTools access
The debugger permission gives an extension full Chrome DevTools Protocol access — cookies, keystrokes, any page. Here's what it allows and how to check yours.
Maxim Kosterin
9 min read
Chrome extension side panels: build a UI that stays open while you browse
A hands-on Manifest V3 tutorial: build a Chrome extension side panel that persists across tabs, then make it per-site. Full runnable code, ~25 minutes.
Maxim Kosterin
13 min read
Volume booster extensions reviewed: which sound boosters are safe, and which are spyware
Are volume booster extensions safe? I break down the permissions, the 1.5M-user sleeper spyware LayerX found, and how to spot a sound booster worth trusting.
Maxim Kosterin
9 min read
App-Bound Encryption bypass: how infostealers raid your browser extensions
Infostealers now bypass Chrome's App-Bound Encryption to raid crypto wallet and password manager extensions. Here's how to check yours and lock them down.
Maxim Kosterin
8 min read
Extension Pulse, week of July 27: Chrome 151 deletes the last MV2 flags. There is no bypass.
Chrome 151 deletes every remaining MV2 flag. Messaging gets structured clone. setBadgeText is capped at 100 bytes.
Maxim Kosterin
3 min read
webNavigation permission explained: what browser extensions see when you move around the web
The webNavigation permission lets an extension watch every URL you open live — no host permissions, no injected code. Here's what it sees and how to check.
Maxim Kosterin
7 min read
Website blocker extensions reviewed: BlockSite, StayFocusd, Freedom & Forest privacy compared
I compared four popular website blocker extensions on permissions and data sharing. Here's which focus tools keep your browsing private and which don't.
Maxim Kosterin
9 min read
The extension that opens whatever tab its server tells it to
A malicious browser extension can let a remote server open any tab — an ad, a redirect, a fake login. How it works, and how to check and remove them fast.
Maxim Kosterin
7 min read
Extension Pulse, week of July 20: Chrome Web Store's new privacy rules land August 1
CWS data-minimisation rules enforce August 1. Firefox 153 ships tomorrow. Firefox and Safari just lined up behind COOP/COEP for extension pages.
Maxim Kosterin
4 min read
GlassWorm botnet takedown: how to check if your extensions are still infected
The GlassWorm takedown by CrowdStrike and Google won't uninstall anything. Here's how to check for malicious browser extensions still sitting in your browser.
Maxim Kosterin
10 min read
The `management` permission explained: what one extension can learn about all your others
The management permission lets a browser extension list every other extension you've installed and toggle them off. Here's what it exposes and how to check.
Maxim Kosterin
8 min read
Screen recorder extensions reviewed: the permissions they hold, the Screencastify webcam bug & safer picks
Screen recorder extensions can reach your camera, mic and every tab. Here's the permission breakdown, the Screencastify webcam bug, and how to record safely.
Maxim Kosterin
10 min read
Extension Pulse, week of July 13: August 31 is the Chrome Web Store's MV2 funeral
Chrome Web Store yanks remaining MV2 listings on August 31. AI-agent permissions landed at W3C. The MV2 preference storage is already deleted in Chromium.
Maxim Kosterin
4 min read
Fake crypto wallet extensions: how to check your browser for the homoglyph seed-phrase trap
A fake imToken Chrome extension posed as a color picker and phished seed phrases using invisible homoglyphs. Here's how to check your extensions and stay safe.
Maxim Kosterin
8 min read
The `storage` permission explained: what browser extensions keep, and where it actually lives
The storage permission is the most-requested thing extensions ask for — 62% claim it, with no install warning. Here's what it keeps, where, and how to check.
Maxim Kosterin
7 min read
Dark mode extensions review: is Dark Reader safe, and which clones to avoid
Is Dark Reader safe? It reads every site you visit — and so do its clones. My security review of Dark Reader, plus the dark mode copies you should avoid.
Maxim Kosterin
10 min read
108 Chrome extensions, one server: how to check yours for session theft
Socket found 108 Chrome extensions routing logins and live Telegram sessions to a single server. Here's how the campaign worked and how to check your own.
Maxim Kosterin
10 min read
Extension Pulse, week of July 6: 120 more countries can publish, and unlimitedStorage still has no ceiling
Chrome Web Store opens to 120+ countries, Firefox 153 ESR is two weeks out, and W3C still can't agree a cap on unlimitedStorage. Here's what actually matters.
Maxim Kosterin
5 min read
Firefox is about to make file access opt-in — here's what breaks on July 21
Firefox 153 makes extension file access opt-in from July 21 — even for add-ons you already installed. We found 842 Firefox add-ons that request file:// access.
Maxim Kosterin
6 min read
The `proxy` permission explained: what browser extensions can really do with your traffic
The proxy permission lets a browser extension reroute all your traffic through servers it controls. Here's what it really allows — and how to check yours.
Maxim Kosterin
7 min read
Web clipper extensions reviewed: Evernote, Notion, Raindrop & Obsidian permissions compared
I compared four web clipper extensions on permissions and data flow. Which read every page you visit, which stay local, and which one I'd actually trust.
Maxim Kosterin
10 min read
Session cookie theft: how Chrome's DBSC protects you — and where extensions still get in
Session cookie theft lets attackers skip your login and 2FA. Chrome 146's DBSC binds sessions to your device — but here's the gap extensions still exploit.
Maxim Kosterin
10 min read
unlimitedStorage explained: the extension permission with no ceiling — and the W3C plan to add one
The unlimitedStorage permission lets extensions hoard data on your disk with no cap. ~687M users are exposed — and W3C is debating a limit on July 2, 2026.
Maxim Kosterin
6 min read
activeTab permission explained: the host access that skips Chrome's warning
The activeTab permission lets browser extensions touch the page you're on — only when you click, with no scary install warning. Here's what it grants.
Maxim Kosterin
7 min read
Tab manager extensions reviewed: OneTab, Toby, Workona & Session Buddy privacy compared
I compared four popular tab manager extensions on permissions, data sync, and privacy. Here's which keep your tab list local and which ship it to the cloud.
Maxim Kosterin
7 min read
Can a disabled extension skip its own uninstall URL? In Chrome, no — here's why
A disabled extension can't clear its uninstall URL (setUninstallURL) before removal — the service worker is already dead. Here's why, and the server-side fix.
Maxim Kosterin
11 min read
Abandoned browser extensions: how to check the add-ons that stopped getting security updates
Two-thirds of Edge extensions and half of Firefox add-ons sit abandoned — no security update in a year. Why stale extensions are risky and how to check yours.
Maxim Kosterin
10 min read
Chrome's native browser namespace: what cross-browser extension devs should do now
Chrome added a native, promise-based browser.* namespace in 148. Across the 235,887 Chrome extensions we track, here's what it changes — and what to do.
Maxim Kosterin
5 min read
The `history` permission explained: what an extension can dig out of your past
The history permission lets a browser extension read every site you visited — even before you installed it. Here's what it exposes and how to check yours.
Maxim Kosterin
6 min read
We counted what Chrome's Manifest V2 sunset actually removed — and it wasn't the ad blockers
Everyone said Chrome's Manifest V2 deadline would kill ad blockers. Here's what the sunset actually stranded — and why Firefox is now the MV2 refuge.
Maxim Kosterin
6 min read
Are YouTube extensions safe? SponsorBlock, Return YouTube Dislike & Enhancer for YouTube reviewed
SponsorBlock, Return YouTube Dislike and Enhancer for YouTube checked on permissions, privacy, and how to spot risky clones.
Maxim Kosterin
8 min read
Fake ad blocker crashes your browser on purpose: how to spot the CrashFix trap
A fake uBlock Origin clone crashed Chrome on purpose, then tricked users into running malware. Here's how to spot the CrashFix trap and check your extensions.
Maxim Kosterin
8 min read
The `webRequest` permission explained: what browser extensions can really see in your traffic
The webRequest permission lets browser extensions watch — and sometimes rewrite — every network request you make. Here's what it really sees and how to check.
Maxim Kosterin
6 min read
Turn extension uninstalls into feedback with one line of code
chrome.runtime.setUninstallURL opens a page after someone uninstalls your extension. Here's how to turn that uninstall moment into structured churn feedback.
Maxim Kosterin
5 min read
Are translation extensions safe? Google Translate, DeepL & Immersive Translate privacy review
Translation extensions read the full text of every page you translate. I review Google Translate, DeepL, and Immersive Translate on permissions and data flow.
Maxim Kosterin
9 min read
Runtime tracking explained: what browser extensions do that their permissions never show
An ACM study found 15.97% of extensions start third-party tracking within 60 seconds. Here's why the permission list never told you, and how to check.
Maxim Kosterin
7 min read
Are coupon extensions safe? Honey, Rakuten & Capital One Shopping privacy review
Coupon and cashback extensions watch every site you visit. I review Honey, Rakuten, and Capital One Shopping on permissions, privacy, and the affiliate mess.
Maxim Kosterin
7 min read
Extension permissions by the numbers: what 308,000 browser extensions actually request
I mapped browser extension permissions across 308,210 live listings: 62% claim storage, 7.4% can read every site you visit. Here's what to pause on.
Maxim Kosterin
8 min read
Malware hidden in extension icons: how to check your browser for GhostPoster
GhostPoster hid malware inside extension icon images for up to five years across Chrome, Firefox, and Edge. Here's how steganography works and what to check.
Maxim Kosterin
8 min read
Browser fingerprinting in Chrome: what websites actually see, and which extensions really help
A privacy researcher says Chrome ships almost no fingerprinting defenses. Here's what sites can really learn about you — and which extensions help.
Maxim Kosterin
8 min read
Screenshot extensions reviewed: the permissions they really need, the ShotBird hijack & safer alternatives
Screenshot extensions can read every page they capture. Here's the permission breakdown, what the ShotBird hijack revealed, and how to grab screens safely.
Maxim Kosterin
9 min read
The Chromium service worker flaw: how to protect your browser and extensions
Google accidentally exposed an unfixed Chromium service worker flaw that keeps background scripts running after you close the browser. Here's how to stay safe.
Maxim Kosterin
9 min read
NordVPN AI Voice Detector review: on-device deepfake detection, privacy score & alternatives
The NordVPN extension's new on-device AI voice detector flags deepfake audio without sending anything anywhere. Review of permissions, privacy and alternatives.
Maxim Kosterin
9 min read
AI extension OAuth tokens: how to audit your connected apps after the Vercel breach
A Chrome extension's leaked OAuth tokens pivoted into Vercel's systems. Here's how to audit the extension OAuth grants in your work Google account.
Maxim Kosterin
8 min read
AI agent extension permissions explained: what 'read all your data on all websites' really allows
An AI agent extension like OpenAI's Codex asks to 'read all data on all websites.' Here's what it really allows, why agents need it, and how to check yours.
Maxim Kosterin
8 min read
ClaudeBleed explained: how any Chrome extension can hijack Claude without a single permission
Any zero-permission extension can hijack Claude's AI session and exfiltrate your Gmail or GitHub data. Here's how ClaudeBleed works and how to protect yourself.
Maxim Kosterin
9 min read
Extension privacy policies explained: what 'we may sell your data' actually means
LayerX found 82 Chrome extensions legally sell 6.5M users' data via buried privacy policies. Here's how the fine-print loophole works and how to check yours.
Maxim Kosterin
8 min read
Streaming enhancement extensions reviewed: security analysis, data practices & safer alternatives
24 streaming extensions in the QVI Empire network legally sell your Netflix and Hulu viewing data. Privacy analysis, risk breakdown, and safer alternatives.
Maxim Kosterin
7 min read
Enterprise HR credential theft via Chrome extensions: how to protect your Workday and SAP accounts
Five Chrome extensions stole Workday, NetSuite, and SAP session tokens using three attack vectors. Here's how enterprise teams can check and protect HR access.
Maxim Kosterin
10 min read
The `nativeMessaging` permission explained: what browser extensions can really do outside your browser
The native messaging permission lets browser extensions talk to native apps outside Chrome's sandbox. Here's what it really enables — and how to check yours.
Maxim Kosterin
8 min read
Ad blocker extensions reviewed: Stands AdBlocker, Poper Blocker & safer alternatives
Some ad blockers that sell your data are among the most installed on Chrome. LayerX flagged 12 — here's the breakdown of the worst and safer 2026 alternatives.
Maxim Kosterin
8 min read
Browser extension sideloading attacks: how to detect SNOWBELT before it owns your enterprise
A sideloaded browser extension is how UNC6692's SNOWBELT runs inside headless Edge, skipping Web Store review entirely. Here's how to detect it in your org.
Maxim Kosterin
10 min read
AI browser assistant extensions explained: what nine popular add-ons were actually doing with your data
AI browser assistant data collection can sweep up your SSN and medical data — UC Davis tested 9 GenAI extensions and found just that. Here's what they access.
Maxim Kosterin
7 min read
TikTok downloader extensions reviewed: security scores, the StealTok campaign & safer alternatives
Most TikTok downloader extension clones are spyware — StealTok spied on 130K users for up to a year. Here's the security breakdown and safer ways to download.
Maxim Kosterin
9 min read
Browser AI panel hijacking: how to check which of your Chrome extensions can abuse elevated privileges
Chrome extension privilege escalation is real: CVE-2026-0628 let extensions with basic permissions reach your camera, mic, and files via the Gemini panel.
Maxim Kosterin
10 min read
The privacy policy gap explained: what 3,000 Chrome extensions collect without telling you
Georgia Tech's Arcanum study found 3,000+ Chrome extensions collect data silently — and none disclose it in their privacy policy. Here's how to check yours.
Maxim Kosterin
9 min read
Firefox's free built-in VPN reviewed: how it stacks up against VPN extensions
Firefox built-in VPN is free, capped at 50GB/month and 4 countries. Here's how it compares to Proton VPN, Mullvad, and NordVPN extensions — and which to trust.
Maxim Kosterin
12 min read
GlassWorm: how to check if the IDE supply chain attack installed a Chrome infostealer
GlassWorm malware compromised 72+ Open VSX IDE extensions to drop a Chrome infostealer that steals session cookies via Solana C2. Here's what to check today.
Maxim Kosterin
11 min read
Extension fingerprinting explained: what websites can read about you from your installed add-ons
LinkedIn scanned 6,236 Chrome extensions to fingerprint users without consent. Here's how extension fingerprinting works and how to check if you're exposed.
Maxim Kosterin
8 min read
Password manager extensions reviewed: Bitwarden vs 1Password security score, spoofing risks & alternatives
Bitwarden vs 1Password security compared: permissions, audits, vault design, and the SquareX polymorphic spoofing attack Chrome still hasn't patched in 2026.
Maxim Kosterin
11 min read
AI extension incident response: a playbook for enterprise security teams
AI extension incident response, step by step: malicious AI extensions hit 20K+ enterprise tenants with no plan in place. Here's the 60-minute playbook.
Maxim Kosterin
9 min read
The `tabs` permission explained: what browser extensions can really see in your open tabs
The tabs permission lets Chrome extensions log every URL you visit in real time — no history permission needed. Here's what it does and how to audit yours.
Maxim Kosterin
8 min read
Crypto wallet extensions reviewed: MetaMask, Phantom & Trust Wallet security analysis
Crypto wallet extensions are Torg Grabber's top target — 728 of them. Here's how MetaMask, Phantom, and Trust Wallet hold up on security and what to watch for.
Maxim Kosterin
9 min read
ShadyPanda: how to find browser extensions that turned malicious after you installed them
ShadyPanda ran 145 malicious browser extensions on Chrome and Edge for 6 years — from affiliate fraud to keylogging spyware, 4.3M installs. How to check yours.
Maxim Kosterin
10 min read
Video conferencing access explained: what browser extensions can really see in your meetings
18 extensions harvested meeting data from 2.2M users on Zoom, Teams, and Meet. Here's how video conferencing extension access works — and how to audit yours.
Maxim Kosterin
6 min read
Meeting enhancement extensions reviewed: security analysis, privacy risks & safer alternatives
18 Chrome, Firefox, and Edge meeting extensions with 2.2M installs secretly harvested corporate meeting data. Here's what they did and how to check yours.
Maxim Kosterin
9 min read
Chrome Web Store bypass for sale: how to protect your extensions from MaaS phishing kits
Stanley MaaS sold guaranteed Chrome Web Store placement for $6,000. Here's how phishing extensions slip past Google's review — and how to protect yourself.
Maxim Kosterin
9 min read
The `scripting` permission explained: what browser extensions can really inject into your pages
The scripting permission lets extensions run JavaScript on any page you visit — including your Zoom calls. Here's what that actually means for your privacy.
Maxim Kosterin
8 min read
Grammarly vs QuillBot extension review: privacy score, data collection & safer alternatives
Incogni's 2026 study flags Grammarly and QuillBot as high-risk AI extensions. Privacy analysis, permission breakdown, and safer alternatives for 2026.
Maxim Kosterin
9 min read
Host permissions explained: what 'read and change all your data on all websites' really means
Browser extension host permissions let extensions read and change every website you visit. Here's what that warning actually means and when to be concerned.
Maxim Kosterin
8 min read
Proton VPN extension review: security score, privacy analysis & safer alternatives
The real Proton VPN extension is a standalone browser VPN — with broad permissions by design. Here's what it actually requests and how to spot the fakes.
Maxim Kosterin
11 min read
Zero-permission malware droppers: how to check if any of your extensions can be weaponized
A zero-permission extension can still drop malware: LayerX Labs showed any extension can silently backdoor your downloads. How to check and stay safe.
Maxim Kosterin
9 min read
The `cookies` permission explained: what browser extensions can really access in your sessions
The cookies permission lets extensions read, write, and delete cookies — including session tokens. Here's what that means for your accounts and how to check.
Maxim Kosterin
9 min read
Enterprise browser extension audit tools reviewed: LayerX, CrowdStrike, and Defender compared
Browser extension audit tools compared: LayerX, CrowdStrike Falcon, and Microsoft Defender. What each one does, where it falls short, and which fits your team.
Maxim Kosterin
8 min read
Extension ownership transfers: how to protect yourself when your add-on changes hands
QuickLens got hijacked via an extension ownership transfer to push ClickFix and crypto-stealing malware. Here's how to check your own add-ons are still safe.
Maxim Kosterin
8 min read
Extension email access explained: what browser add-ons can really see in your inbox
Over 200 extensions silently pull email from Gmail and Outlook. Here's how extension email access works and how to check which add-ons can read your inbox.
Maxim Kosterin
7 min read
Password manager extensions reviewed: what ETH Zurich's 25-attack study means for your vault
ETH Zurich broke the zero-knowledge promise in Bitwarden, LastPass, and Dashlane with 25 attacks. See which password manager extensions actually held up best.
Maxim Kosterin
7 min read
Man-in-the-prompt attacks: how to stop browser extensions from hijacking your AI conversations
Any browser extension can silently inject commands into ChatGPT, Gemini, and Claude. Here's how man-in-the-prompt attacks work and how to keep yourself safe.
Maxim Kosterin
8 min read
AI extension data collection explained: what your Chrome AI tools can really access
AI extension data collection is real: 52% of AI Chrome extensions collect user data. Here's what scripting permissions let them see, and how to check yours.
Maxim Kosterin
8 min read
Urban VPN review: how a "Featured" Chrome extension harvested 8 million users' AI chats
Is Urban VPN safe? Not after it quietly harvested ChatGPT, Claude and Gemini chats from 8M users. The full review, the timeline, and what to install instead.
Maxim Kosterin
10 min read
declarativeNetRequest in browser extensions: what a peer-reviewed study says about MV3 ad blocking
A peer-reviewed study found Manifest V3 ad blocking matches MV2 effectiveness. Here's what declarativeNetRequest really changes if you build content filters.
Maxim Kosterin
10 min read
300+ malicious Chrome extensions with 37 million downloads: how to check if you're affected
Security researchers exposed 300+ malicious Chrome extensions with 37.4M downloads stealing data, credentials, and emails. Here's how to protect yourself.
Maxim Kosterin
9 min read
Extension frameworks in 2026: how to pick the right one for your next project
WXT, Plasmo, CRXJS, Extension.js, and Bedframe — five browser extension frameworks compared by build time, bundle size, and maintenance health in 2026.
Maxim Kosterin
9 min read
Data collection consent in Firefox extensions: how to implement Mozilla's new manifest requirement
Mozilla now requires all Firefox extensions to declare data collection in manifest.json. Here's exactly how to implement data_collection_permissions correctly.
Maxim Kosterin
9 min read
Browsing history exfiltration explained: what 287 Chrome extensions were really doing
A researcher found 287 Chrome extensions allegedly leaking browsing history to third-party companies. Here's how it works and how to check yours.
Maxim Kosterin
7 min read
Fake AI extensions stealing credentials: how to spot them before they read your Gmail
30 fake AI Chrome extensions caught stealing credentials and Gmail data from 300K users. Here's how to check if you're affected and protect yourself.
Maxim Kosterin
6 min read
Sleeper extensions go cross-browser: how to find hidden malware in your Firefox, Chrome, and Edge add-ons
17 malicious sleeper extensions found across Firefox, Chrome, and Edge with 840K downloads. They hid malware in images for up to 5 years undetected.
Maxim Kosterin
8 min read
Explore Topics
chrome-extensions (78)privacy (58)browser-extensions (43)permissions (32)extension-security (32)manifest-v3 (20)extension-development (19)extension-review (15)tutorial (14)firefox (14)chrome-web-store (12)ai-extensions (11)malware (10)data-collection (9)extension-pulse (8)w3c (8)supply-chain (8)security (7)enterprise-security (7)extension reviews (6)browser extensions (6)vpn-extensions (5)browser-security (5)service-worker (4)cookies (4)manifest-v2 (4)ai-agents (4)crypto-wallets (4)fingerprinting (4)extension review (4)credential-theft (4)microsoft-edge (3)content-scripts (3)webextensions (3)declarativeNetRequest (3)infostealer (3)password-managers (3)phishing (3)host-permissions (3)data-selling (3)omnibox (2)activetab (2)agentic-ai (2)claude (2)chrome-offscreen (2)webnavigation (2)proxy (2)native-messaging (2)edge-extensions (2)social-engineering (2)sandbox (2)tracking (2)storage (2)data-story (2)oauth (2)unlimitedstorage (2)session-security (2)service-workers (2)edge (2)cross-browser (2)ad-blocking (2)clickfix (2)steganography (2)ownership-transfer (2)zero-permission (2)privilege-escalation (2)privacy-policy (2)data-brokers (2)academic-research (2)layerx (2)ai-security (2)bitwarden (2)1password (2)video-conferencing (2)corporate-espionage (2)gmail (2)chatgpt (2)i18n (1)localization (1)scripting (1)clipboard (1)clipboardread (1)istrusted (1)chrome-privacy (1)browsingdata (1)contentsettings (1)tabcapture (1)mediarecorder (1)privacy-permission (1)browser-settings (1)firefox-add-ons (1)publishing (1)2fa (1)authenticator (1)totp (1)update-hijacking (1)affiliate-fraud (1)management-api (1)cookie-extensions (1)single-page-apps (1)brand-impersonation (1)scripting-api (1)new-tab (1)topsites (1)text to speech (1)optional-permissions (1)sandbox-escape (1)ransomware (1)standards (1)network-requests (1)downloads-permission (1)pdf extensions (1)amo (1)chrome-alarms (1)debugger (1)devtools-protocol (1)side-panel (1)extension-ui (1)volume booster (1)app-bound-encryption (1)website blockers (1)productivity (1)webrequest (1)server-controlled (1)installed-extensions (1)extension-scanner (1)glassworm (1)botnet-takedown (1)management-permission (1)screen-recorder-extensions (1)camera (1)microphone (1)seed-phrase (1)homoglyph (1)dark mode extensions (1)dark reader (1)extension security (1)browser privacy (1)session-theft (1)data-exfiltration (1)firefox-extensions (1)file-access (1)extension-permissions (1)web clippers (1)cookie-theft (1)tab managers (1)abandoned-extensions (1)extension-maintenance (1)browser-namespace (1)history-permission (1)google (1)youtube extensions (1)sponsorblock (1)fake-extensions (1)webRequest (1)network (1)developers (1)analytics (1)churn (1)uninstall (1)translation extensions (1)deepl (1)google translate (1)coupon extensions (1)honey (1)rakuten (1)all-urls (1)chrome (1)brave (1)screenshot-extensions (1)chromium (1)zero-day (1)nordvpn (1)deepfake-detection (1)on-device-ai (1)voice-cloning (1)google-workspace (1)vercel (1)openai-codex (1)externally-connectable (1)legal-spyware (1)streaming-extensions (1)netflix (1)hulu (1)disney-plus (1)workday (1)netsuite (1)sap (1)session-hijacking (1)socket (1)ad-blockers (1)ublock-origin (1)sideloading (1)snowbelt (1)unc6692 (1)edge-browser (1)genai (1)tiktok (1)stealtok (1)sleeper-extension (1)gemini (1)cve (1)transparency (1)firefox-149 (1)developer-security (1)ide-extensions (1)linkedin (1)polymorphic-extension (1)incident-response (1)extension-management (1)security-playbook (1)tabs-permission (1)metamask (1)phantom (1)trust-wallet (1)spyware (1)long-running-campaign (1)zoom (1)meeting-extensions (1)darkspectre (1)malware-as-a-service (1)scripting-permission (1)grammarly (1)quillbot (1)proton-vpn (1)extension-audit (1)crowdstrike (1)microsoft-defender (1)risk-assessment (1)crypto-security (1)email-security (1)dom-access (1)lastpass (1)dashlane (1)zero-knowledge (1)prompt-injection (1)ai-chat-security (1)deepseek (1)malicious-extensions (1)data-theft (1)wxt (1)plasmo (1)crxjs (1)developer-tools (1)manifest-json (1)mozilla (1)browsing-history (1)sleeper-extensions (1)