Pixel Perfect Browser Extension Exploited for Stealth Script Injection and Security Header Stripping

The Chrome extension "QuickLens – Search Screen with Google Lens" has transitioned from a productivity tool to a platform capable of remote code execution, exploiting browser trust, security headers, and silent auto-updates. Initially, it functioned as a Google Lens wrapper but evolved into a campaign capable of injecting scripts into any visited site.

Early versions of QuickLens utilized a background service worker for window and capture management, alongside a content script for UI overlays. Network calls were limited to Google domains, with no obfuscation or suspicious logic. The extension's permissions, which included activeTab, scripting, screen capture, and a content script for all pages, appeared standard for its functionality.

Ownership Change and Malicious 5.8 Release

QuickLens was listed for sale on ExtensionHub shortly after its launch, a common practice in extension-based supply chain attacks. On Feb 1, 2026, control shifted to "LLC Quick Lens," and a new privacy policy was introduced, signaling a possible throwaway entity. By Feb 17, 2026, version 5.8 was released, incorporating declarativeNetRequestWithHostAccess and webRequest permissions, a rules.json file, and a C2-aware background.js file, which were absent in the benign 5.7 version.

Google has removed the extension due to a "policy violation," but the changes indicate a clear attempt to bypass browser defenses and monetize user browsing sessions. The rules.json file uses Chrome's declarativeNetRequest API to modify HTTP responses, removing key security headers to allow inline script execution and other vulnerabilities.

The updated background script connects to api.extensionanalyticspro.top, registering a persistent UUID, fingerprinting the user's country, collecting browser/OS data, and polling for instructions. The server provides JavaScript strings stored in local storage, with webRequest handlers triggering on-demand refreshes. Execution occurs via a hidden 1×1 GIF element, allowing arbitrary script execution in the page context.

For defenders, this incident underlines the necessity of treating browser extensions as part of the enterprise supply chain, monitoring ownership changes, flagging new network permissions, and employing runtime behavior analysis to detect covert script injection.

Type Value

Extension ID kdenlnncndfnhkognokgfpabgkgehodd

Extension Name QuickLens – Search Screen with Google Lens

C2 Domain api.extensionanalyticspro[.]top

Developer Email support@doodlebuggle[.]top

Privacy Policy kowqlak[.]lat

Malicious Version 5.8

SHA256 fa3d0c8c8e9f3dacaa9f34e42ad63dceeba16689e055b90e9a903fa274d35df0

Based on reporting by GBHackers.