Back to Resources
    When a trusted browser extension turns hostile: how extension takeovers work and how to catch them
    Blog

    When a trusted browser extension turns hostile: how extension takeovers work and how to catch them

    October 3, 2026

    Table of Contents

    An extension takeover happens when a browser extension end users already trust starts doing something malicious after an update. The developer's account gets phished, or the extension is quietly sold, and the new code ships to every existing user automatically. Nobody reinstalls anything, so nobody notices. The fix isn't telling end users to be careful. It's controlling which extensions can run at all and watching what the approved ones are allowed to do.

    How does a trusted extension turn malicious?

    An extension doesn't need to start out bad. It needs to be trusted first, because trust is what gets it installed on thousands of machines with broad permissions. The takeover comes later, through one of three routes.

    1. The developer's account gets hijacked. Attackers phish the person who publishes the extension, then push their own version through the normal update channel. On Christmas Eve 2024, a Cyberhaven employee was phished by an email posing as Chrome Web Store support, warning that the company's extension would be removed for a policy violation. The link led to a consent page for a malicious app, which gave the attacker publishing rights. A malicious version went out, passed store review, and stayed live for about a day. Researchers later tied the same campaign to dozens of other extensions.

    2. The extension gets sold. Small extension developers get regular offers to buy their work, and the end users who have it installed aren't told when it changes hands. In February 2026, a screen-capture extension called QuickLens changed hands. About two weeks later, the new owner shipped an update that stripped security headers from every website the end user visited and pulled down fresh code from a remote server every five minutes. A sister extension that had earned a "Featured" badge went the same way.

    3. The extension was a sleeper all along. Some operators build an audience on purpose, then switch. Researchers reported in December 2025 that a group had run legitimate Chrome and Edge extensions for years, some carrying Google's "Featured" and "Verified" badges. In mid-2024, an update turned five of them, with about 300,000 users, into tools that could run any code the operator sent. Across the whole operation, including spyware extensions on Edge, about 4.3 million browsers were affected.

    There's also a quieter fourth version, in which an extension stays "legitimate" but changes what it collects. One popular free VPN extension pushed an update in July 2025 that started capturing conversations from AI chat services. Existing end users never saw a new consent prompt.

    What can a hostile extension actually do?

    Whatever its permissions allow, and many common extensions ask for a lot. The warning "Read and change all your data on the websites you visit" sounds alarming, but end users click through it constantly because so many useful tools need it. Once an extension holds that kind of access, a malicious update can:

    • Read session cookies and tokens. That's a signed-in session handed to the attacker, MFA already completed. It's one of the quieter routes to session hijacking.
    • Capture what end users type. One recent takeover hooked form fields to capture credentials, PINs, card details, tokens, and government ID numbers.
    • Read everything on the page, including AI chats. At the end of December 2025, two extensions posing as AI sidebars were caught copying ChatGPT and DeepSeek conversations, plus every open tab's address, to the attacker every 30 minutes. They had about 900,000 users between them, and Microsoft later reported activity tied to them across more than 20,000 enterprise tenants.
    • Change what the end user sees. One sold extension showed a fake Chrome update prompt that walked end users through pasting a command into the Windows Run box, the same trick used in ClickFix attacks.
    • Weaken the site itself. Stripping security headers from every page makes other attacks against the end user easier.

    The common thread is that all of this happens inside the browser, on real sites, in a session the end user legitimately opened. To the end user and to most security tools, it looks like normal browsing.

    Why do takeovers get past end users and store review?

    The update channel is trusted by design. Extensions update themselves in the background, and the permission an end user granted on day one carries over to every version that follows.

    Chrome does have one safeguard. If an update asks for new permissions that come with a warning, Chrome disables the extension until the end user accepts them. But a takeover often doesn't need new permissions. It targets an extension that already has broad access, so the malicious version installs silently with the permissions the old one earned.

    Store badges don't help much either. A "Featured" or "Verified" label describes the extension as it was when it was reviewed, not what the next update will do. Cyberhaven's malicious version passed review, and several of the sleeper extensions carried both badges.

    The result is a trust model that checks the front door once and then leaves it open.

    Why don't the usual security tools catch it?

    Most of the stack is looking in the wrong place.

    • Endpoint protection sees a browser doing browser things. The malicious code runs inside a signed, trusted browser process. Often there's no new executable to flag.
    • Network tools see normal web traffic. Stolen data usually leaves over ordinary HTTPS, often in small batches on a timer. The Cloud Security Alliance's 2026 research on AI extensions noted that DLP, CASB, and EDR tools generally can't see what an extension does inside the page.
    • User training can't help much here. The end user installed a popular, reviewed extension, maybe one with a badge. They did everything right. Telling end users to "only install trusted extensions" doesn't help when the trusted one is the problem.
    • Nobody has the list. Ask most MSPs which extensions are installed across a client's browsers, at which version, with which permissions, and the honest answer is that they don't know. You can't respond to a takeover in an extension you didn't know was there.

    That last point is the one to fix first. Every other control depends on it.

    How can MSPs catch an extension takeover?

    You can't predict which extension gets phished or sold next. You can make sure that when it happens, the extension either can't run or can't reach anything that matters, and that you find out fast. In order:

    1. Build an inventory for every client. List every extension in every managed browser, with its version and permissions. Chrome's admin console reports installed extensions by version and permission. On the Microsoft side, coverage depends on which Edge and Defender tools a client has. Browser security platforms can collect it across tenants. Without it, every other step is guesswork.
    2. Move from "allow by default" to an allowlist. Both Chrome and Edge let you block all extensions by policy, then allow approved ones by ID. Start by blocking known-risky extensions, agree a short approved list with each client, then flip the default. Most businesses need far fewer extensions than they have installed, so limit the approved list to the extensions end users need for work.
    3. Limit what approved extensions can touch. An allowlist decides what runs. Permission controls decide what it can reach. Browser policy can block specific permissions outright and stop extensions from reading or changing chosen sites, up to 100 of them. Put sign-in pages, banking, payroll, and admin consoles on that list first.
    4. Watch for change, not just for bad names. The warning signs of a takeover are a new owner or publisher, a jump in requested permissions, a long-quiet extension that suddenly updates, or an extension pulled from the store. Review the approved list on a schedule, and drop anything abandoned or recently sold.
    5. Have a removal plan ready. When an extension is reported compromised, remove it everywhere by policy rather than asking end users to uninstall it. Then treat it as a session theft incident for everyone who had it by revoking sessions, resetting passwords, and reviewing what the extension could read. If a fixed version ships later, Chrome and Edge policy can set a minimum version so the bad one stays disabled.

    For most small business clients, steps 1 and 2 remove the bulk of the risk. Steps 3 to 5 matter more as clients handle more sensitive data.

    Doing this across many clients

    Browser policy covers all of this for one organization. The hard part for an MSP is doing it for dozens of tenants with different needs, without hand-editing policy for each one. That's where a browser security platform earns its place. Atakama, for example, inventories extensions across every client tenant, shows what each one is permitted to read, and applies allow and block lists per client from one console. Whatever tool you use, the goal is the same, which is one view of every extension and one place to pull it when the next takeover hits.

    FAQ

    Can a legitimate browser extension become malicious?

    Yes. A trusted extension can turn malicious through an update after its developer's account is hijacked, after it's sold to a new owner, or because its operator planned the switch all along. The update installs automatically for existing users.

    How do I know if a browser extension has been compromised?

    Usually you won't see it from the end user's side. Look for a change of owner or publisher, newly requested permissions, an update after a long quiet period, or the extension disappearing from the store. Security researchers and vendor advisories often name compromised extensions first, so check those against your inventory.

    Do Chrome Web Store reviews and badges mean an extension is safe?

    They mean it passed review at a point in time. Malicious updates have been approved for publication, and extensions with "Featured" and "Verified" badges have been weaponized later.

    Does Chrome warn users when an extension update adds permissions?

    Only when the new permissions carry a warning. Chrome then disables the extension until the end user accepts. An update that stays within existing permissions installs automatically, with no prompt.

    What's the best way to manage browser extensions across many clients?

    Keep an inventory per client, enforce an allowlist through browser policy, restrict sensitive sites and permissions, and have a way to remove an extension everywhere at once when one is reported compromised.

    What should I do if a client used a compromised extension?

    Remove it by policy everywhere it's installed, then treat it as possible session and credential theft by revoking sessions, resetting passwords, and reviewing what the extension could access.

    Keep reading

    For more on how attacks start in the browser, see why MFA alone doesn't stop session hijacking, how ClickFix and fake AI installers work, and our pages on extension management, credential theft prevention, and phishing protection.

    Sources

    browser extensions
    extension management
    supply chain attacks
    browser security
    msps

    Related Articles

    Newsletter

    Stay ahead of browser threats

    Get monthly security insights, product updates, and expert guides delivered to your inbox.

    No spam. Unsubscribe anytime.