Pixel Perfect Extension Abuse Enables Covert Script Injection and Security Header Removal
A browser extension that previously earned a Featured badge from Google has become a tool for remote code execution following a change in ownership, impacting over 7,000 users through covert script injection and the removal of browser security headers.
A browser extension that previously earned a Featured badge from Google has become a tool for remote code execution following a change in ownership, impacting over 7,000 users through covert script injection and the removal of browser security headers.
This incident involves a legitimate-looking Google Lens wrapper called QuickLens, demonstrating how a functional extension can be compromised through a silent update.
QuickLens allowed users to search images using Google Lens directly from their browsers, offering features such as screen capture, area selection, YouTube frame search, and Amazon product lookup. It gained a user base of 7,000 and received a Featured badge from Google.
Initially published on the Chrome Web Store on Mon, Oct 9, 2025, it was listed for sale on ExtensionHub on Wed, Oct 11, 2025, a marketplace where developers sell extensions and user bases.
The extension's ownership was transferred to an unverified entity under the domain supportdoodlebuggle.top on Feb 1, 2026. A new privacy policy was issued at kowqlak.lat. On Feb 17, version 5.8 was released, introducing a command-and-control (C2) platform to all users.
Three major changes were introduced: a C2 server at api.extensionanalyticspro.top, new permissions (declarativeNetRequestWithHostAccess and webRequest), and a new rules.json file.
The rules.json file removed browser security headers from HTTP responses, including Content-Security-Policy (CSP), X-Frame-Options, and X-XSS-Protection, exposing users to clickjacking, cross-site scripting, and unrestricted cross-domain requests.
The extension employs a technique wherein JavaScript code is delivered from the C2 server as an array of strings, stored in the browser’s local storage as cached-agents-data . The code executes via a 1×1 transparent GIF image, loaded instantly without network requests.
It gained a user base of 7,000 and received a Featured badge from Google.
The JavaScript payload attaches as an inline onload attribute on the image element, executing in the context of the current page, allowing access to session tokens, form inputs, and page content.
This mechanism bypasses CSP, as version 5.8 removed these headers globally, allowing the payload to execute across all pages.
The malicious payload is not present in the extension’s source files, with static code analysis revealing a function creating image elements. JavaScript from the C2 server appears only at runtime.
Organizations should enforce strict browser extension allowlisting and monitor for unexpected permission changes. Users should audit installed extensions regularly and treat unsolicited permission updates cautiously, especially when extensions change ownership.
Type Value
Extension ID kdenlnncndfnhkognokgfpabgkgehodd
Extension Name QuickLens – Search Screen with Google Lens
Malicious Version 5.8
C2 Domain api.extensionanalyticspro.top
Developer Email support@doodlebuggle.top
Privacy Policy Domain kowqlak.lat
SHA-256 fa3d0c8c8e9f3dacaa9f34e42ad63dceeba16689e055b90e9a903fa274d35df0
Removal Date 2026-02-17
Based on reporting by Cyber Security News.