Over 100 Seemingly Harmless Google Chrome Extensions Found to be Malicious

A report by Socket has identified 108 malicious extensions on the Google Chrome Web Store. These extensions collectively account for around 20,000 downloads.

Although the extensions appeared to offer legitimate utility or entertainment features, researchers found that all of them connected to the same command-and-control server, indicating a coordinated operation.

Examples

Several of the flagged extensions include tools and apps with over 1,000 installs. These include Web Client for TikTok, Web Client for Telegram, YouSide for YouTube, Page Auto Refresh, Page Locker, Text Translation, and Telegram Multi-account. Other extensions, such as Speed Test for Chrome and Clear Cache Plus, were also identified among the affected list.

The report found that these extensions were capable of injecting advertisements into users’ browsing sessions. This likely allowed developers to generate revenue.

In addition, the extensions were found to collect user data, raising concerns about privacy and potential exposure of sensitive information, including login credentials.

The findings follow earlier incidents involving browser extensions flagged as unsafe. These events have contributed to increased attention on extension security, an area that has traditionally been overlooked compared to mobile app ecosystems.

What Users Should Do

Users who have installed any of the affected extensions are advised to remove them immediately. This can be done by opening the browser menu, navigating to Extensions, and selecting Manage Extensions to uninstall suspicious add-ons.

Despite the findings, some of the identified extensions remain available on the Chrome Web Store.

Unclear Impact

The full extent of the damage caused by these extensions is not yet known. However, the combination of ad injection and data collection highlights ongoing risks associated with unverified browser add-ons.