{"id":48562,"date":"2023-07-04T09:07:17","date_gmt":"2023-07-04T13:07:17","guid":{"rendered":"https:\/\/www.kaspersky.com\/blog\/?p=48562"},"modified":"2023-07-06T04:46:07","modified_gmt":"2023-07-06T08:46:07","slug":"dangerous-chrome-extensions-87-million","status":"publish","type":"post","link":"https:\/\/www.kaspersky.com\/blog\/dangerous-chrome-extensions-87-million\/48562\/","title":{"rendered":"Malicious extensions in the Chrome Web Store"},"content":{"rendered":"

Not so long ago, a few dozen malicious plugins were discovered in the Chrome Web Store (the official browser extension store for Google Chrome). The most popular of these extensions had over nine million downloads, and altogether these plugins had been downloaded around 87 million times. We explain what these extensions are and why they\u2019re dangerous.<\/p>\n

Malicious extensions in the Chrome Web Store<\/h2>\n

It all began when independent cybersecurity researcher Vladimir Palant found<\/a> an extension called PDF Toolbox containing suspicious code in the Chrome Web Store. At first glance, it was a perfectly respectable plugin for converting Office documents and performing other simple operations with PDF files.<\/p>\n

PDF Toolbox boasted an impressive user base and good reviews, with close to two million downloads and an average score of 4.2. However, inside this extension interesting \u201cadditional functionality\u201d was discovered: the plugin accessed a serasearchtop[.]com site, from where it loaded arbitrary code on all pages viewed by the user.<\/p>\n

Next, Palant searched the Chrome Web Store for other extensions accessing this server and found a couple dozen plugins with similar additional functionality. They were downloaded 55 million times combined.<\/p>\n

Finally, armed with many samples of malicious extensions, he conducted an even more thorough search of Google\u2019s store and discovered 34 malicious extensions<\/a> with completely different core functionalities. Altogether they\u2019ve been downloaded 87 million times. The most popular malicious plugin found by the researcher was \u201cAutoskip for Youtube\u201d with nine million downloads.<\/p>\n

The extensions were uploaded to the Chrome Web Store in 2021 and 2022, which means they\u2019d been there for at least six months when the study was carried out. What\u2019s more, among the reviews to some of them, there were complaints from vigilant users about extensions replacing addresses in search results with adware links. As you can guess, these complaints went unnoticed by Chrome Web Store moderators.<\/p>\n

After Palant\u2019s study was published, as well as another paper<\/a> on the same topic by a team of experts, Google finally removed the dangerous extensions. But it took the authority of several well-known specialists for it to happen. Incidentally, it\u2019s the same story with Google Play \u2014 there, too, ordinary users\u2019 complaints generally go unheeded<\/a>.<\/p>\n

Why malicious browser extensions are particularly nasty<\/h2>\n

In a nutshell, there are three major problems with browser extensions. First is the level of access to user data they have. In fact, to function properly and be useful, any plugin usually needs your consent to Read and change all your data on all websites<\/strong>.<\/p>\n

And yes, it means exactly what it says. As a rule, browser plugins ask for consent to view and change all your data on all sites. That is, they see absolutely everything you do on all sites you visit, and can arbitrarily change the content of a displayed page.<\/p>\n

Here\u2019s what this potentially allows extension creators to do:<\/p>\n