47 articles found
A fake imToken Chrome extension posed as a color picker and phished seed phrases using invisible homoglyphs. Here's how to check your extensions and stay safe.
The storage permission is the most-requested thing extensions ask for — 62% claim it, with no install warning. Here's what it keeps, where, and how to check.
Socket found 108 Chrome extensions routing logins and live Telegram sessions to a single server. Here's how the campaign worked and how to check your own.
The proxy permission lets a browser extension reroute all your traffic through servers it controls. Here's what it really allows — and how to check yours.
Chrome 146's Device Bound Session Credentials make stolen session cookies useless on another machine. How DBSC works and the gap extensions still exploit.
The unlimitedStorage permission lets extensions hoard data on your disk with no cap. ~687M users are exposed — and W3C is debating a limit on July 2.
The activeTab permission lets browser extensions touch the page you're on — only when you click, with no scary install warning. Here's what it grants.
A disabled extension can't clear its uninstall URL (setUninstallURL) before removal — the service worker is already dead. Here's why, and the server-side fix.
Two-thirds of Edge extensions and half of Firefox add-ons sit abandoned — no security update in a year. Why stale extensions are risky and how to check yours.
Chrome added a native, promise-based browser.* namespace in 148. Across the 235,887 Chrome extensions we track, here's what it changes — and what to do.
The history permission lets a browser extension read every site you visited — even before you installed it. Here's what it exposes and how to check yours.
Everyone said Chrome's Manifest V2 deadline would kill ad blockers. Here's what the sunset actually stranded — and why Firefox is now the MV2 refuge.
SponsorBlock, Return YouTube Dislike and Enhancer for YouTube checked on permissions, privacy, and how to spot risky clones.
A fake uBlock Origin clone crashed Chrome on purpose, then tricked users into running malware. Here's how to spot the CrashFix trap and check your extensions.
The webRequest permission lets browser extensions watch — and sometimes rewrite — every network request you make. Here's what it really sees and how to check.
chrome.runtime.setUninstallURL opens a page after someone uninstalls your extension. Here's how to turn that uninstall moment into structured churn feedback.
An ACM study found 15.97% of extensions start third-party tracking within 60 seconds. Here's why the permission list never told you, and how to check.
GhostPoster hid malware inside extension icon images for up to five years across Chrome, Firefox, and Edge. Here's how steganography works and what to check.
Screenshot extensions can read every page they capture. Here's the permission breakdown, what the ShotBird hijack revealed, and how to grab screens safely.
The NordVPN extension's new on-device AI voice detector flags deepfake audio without sending anything anywhere. Review of permissions, privacy and alternatives.
An AI agent extension like OpenAI's Codex asks to 'read all data on all websites.' Here's what it really allows, why agents need it, and how to check yours.
Any zero-permission extension can hijack Claude's AI session and exfiltrate your Gmail or GitHub data. Here's how ClaudeBleed works and how to protect yourself.
LayerX found 82 Chrome extensions legally sell 6.5M users' data via buried privacy policies. Here's how the fine-print loophole works and how to check yours.
24 streaming extensions in the QVI Empire network legally sell your Netflix and Hulu viewing data. Privacy analysis, risk breakdown, and safer alternatives.
Five Chrome extensions stole Workday, NetSuite, and SAP session tokens using three attack vectors. Here's how enterprise teams can check and protect HR access.
The native messaging permission lets browser extensions talk to native apps outside Chrome's sandbox. Here's what it really enables — and how to check yours.
Some ad blockers that sell your data are among the most installed on Chrome. LayerX flagged 12 — here's the breakdown of the worst and safer 2026 alternatives.
AI browser assistant data collection can sweep up your SSN and medical data — UC Davis tested 9 GenAI extensions and found just that. Here's what they access.
CVE-2026-0628 showed extensions with basic permissions could access your camera, mic, and files via Chrome's Gemini panel. Here's how to stay safe.
Georgia Tech's Arcanum study found 3,000+ Chrome extensions silently collect your data — and none disclose it in their privacy policy. Here's how to check.
GlassWorm compromised 72+ Open VSX IDE extensions to deploy a Chrome infostealer stealing session cookies via Solana blockchain C2. Here's what to check.
LinkedIn scanned 6,236 Chrome extensions to fingerprint users without consent. Here's how extension fingerprinting works and how to check if you're exposed.
Bitwarden and 1Password extension security review 2026: permissions, privacy scores, and SquareX's polymorphic spoofing attack that Chrome can't patch.
When malicious AI extensions hit 20K+ enterprise tenants, most teams had no playbook. Here's the incident response plan your org needs before the next campaign.
The tabs permission lets Chrome extensions log every URL you visit in real time — no history permission needed. Here's what it does and how to audit yours.
ShadyPanda ran 145 malicious extensions on Chrome and Edge for 6 years, from affiliate fraud to keylogging spyware with 4.3M installs. How to check yours.
18 Chrome, Firefox, and Edge meeting extensions with 2.2M installs secretly harvested corporate meeting data. Here's what they did and how to check yours.
The scripting permission lets extensions run JavaScript on any page you visit — including your Zoom calls. Here's what that actually means for your privacy.
Incogni's 2026 study flags Grammarly and QuillBot as high-risk AI extensions. Privacy analysis, permission breakdown, and safer alternatives for 2026.
Browser extension host permissions let extensions read and change every website you visit. Here's what that warning actually means and when to be concerned.
LayerX Labs showed any browser extension — even ones with no permissions — can silently modify your downloads to deliver malware. Here's how to stay safe.
The cookies permission lets extensions read, write, and delete cookies — including session tokens. Here's what that means for your accounts and how to check.
QuickLens was hijacked via ownership transfer to push ClickFix attacks and crypto-stealing malware. Here's how to check your extensions are still safe.
52% of AI Chrome extensions collect user data, a 2026 study found. Here's what permissions like scripting actually let them see and how to check yours.
Urban VPN Proxy secretly harvested ChatGPT, Claude, and Gemini chats from 8M users. A separate campaign hit 900K users in 20K+ enterprise tenants.
A Goethe University study found MV3 ad blockers match MV2 effectiveness. Here's what declarativeNetRequest means for developers building content filters.
A researcher found 287 Chrome extensions allegedly leaking browsing history to third-party companies. Here's how it works and how to check yours.