287 Malicious Chrome Extensions Steal Browsing Data from 37.4 Million Users
A recent investigation has identified 287 Chrome extensions that reportedly transmit users’ browsing data to remote servers, affecting approximately 37.4 million installations. This constitutes about 1% of the global Chrome user base according to…
A recent investigation has identified 287 Chrome extensions that reportedly transmit users’ browsing data to remote servers, affecting approximately 37.4 million installations. This constitutes about 1% of the global Chrome user base according to estimates.
The researchers employed an automated testing pipeline to identify extensions with data-leaking behavior. Chrome was run within a Docker container, with all browser traffic routed through a man-in-the-middle (MITM) proxy. The team visited specific web addresses to detect data leakage patterns, focusing on the actual network activity of the extensions rather than their descriptions or permissions.
The findings, including a detailed report and an HTML version, are available on a public GitHub repository .
The study measured data leakage using a metric defined as: bytes_out = R ⋅ payload_size + b . If R ≥ 1.0 , the extension was considered "definitely leaking," while 0.1 ≤ R < 1.0 indicated probable leakage, warranting further manual review.
This constitutes about 1% of the global Chrome user base according to estimates.
The scanning process required approximately 930 CPU-days, with each extension taking an average of 10 minutes to analyze. The researchers refrained from publishing full implementation details to prevent extension developers from adapting their tactics to evade detection.
The extensions were found to be collecting data for various entities, ranging from well-known analytics firms to lesser-known actors. The report mentions organizations like Similarweb, "Big Star Labs," Curly Doggo, and Offidocs, as well as multiple minor brokers.
Beyond privacy issues, leaked URLs can contain sensitive information such as personal identifiers, password reset links, document names, and internal paths, which could be exploited in targeted attacks. The researchers also set up a honeypot with "honey URLs" to monitor subsequent access attempts, noting activity from IP ranges linked to entities such as Kontera, HashDit, and Blocksi AI Web Filter.
Remove extensions that are unfamiliar or no longer in use. Choose extensions from well-known publishers with transparent privacy policies. Review extension permissions, particularly those that can read and change data on all websites visited. Monitor for unusual network activity or browser performance issues after installing extensions. In organizational settings, limit extension installations through administrative policies and allowlist vetted add-ons.
Based on reporting by GBHackers.