Malicious Browser Extensions

Layer 7: Application Medium risk

How it works

Browser extensions can add helpful features such as PDF tools, coupon finders or productivity aids. To work, many request permission to read and change data on every website you visit. A malicious extension, or a legitimate one sold to a new owner and quietly updated, can use that permission to collect passwords, session cookies, form data and browsing history. Extensions update automatically in the background, so a tool that was safe when installed may not stay that way.

Because the extension runs inside the browser, it can see the contents of web-based email, banking, CRM and Microsoft 365 sessions. Some inject ads or redirect searches, while others focus on stealing access to business accounts. Extensions installed on personal browser profiles that are also used for work can expose company data without IT ever knowing. Popular extensions with many positive reviews have been compromised this way, so popularity alone is not a reliable sign of safety.

Warning signs

• Extensions installed that no one remembers adding
• Extensions requesting access to all websites
• Search results or home page changing unexpectedly
• Unexplained pop-ups or injected ads
• Account sessions used from unknown locations

How to defend against it

• Manage browsers centrally and allow only approved extensions
• Review installed extensions on work devices regularly
• Separate work and personal browser profiles
• Use endpoint protection that monitors browser activity
• Educate staff about extension permissions

If it happens to you

1. Remove the extension from all browsers and profiles
2. Sign out of all sessions and change affected passwords
3. Check accounts for suspicious activity
4. Block the extension through browser policy