Malicious Browser Extensions Are a Hidden Security Risk

The web browser—be it Microsoft Edge, Google Chrome, Firefox, or Apple’s Safari—has evolved from a simple portal to the World Wide Web into an indispensable tool that orchestrates a multitude of our daily activities. Extensions elevate our web browsers even further by adding new features and integrating various third-party services.

However, not all extensions that are available today are entirely secure and some are downright malicious. These malicious web browser extensions are a commonly overlooked security risk because many organizations still don’t fully understand the potential consequences and don’t protect themselves sufficiently.

What Are Malicious Browser Extensions?

Malicious browser extensions typically look and function like any regular extension, but they’re programmed to compromise your security and privacy.

To function as intended, extensions often request specific permissions during the installation process. These permissions can range from relatively benign, like displaying notifications, to more invasive ones that can significantly compromise your security. Here are some common permissions extensions typically ask for:

• Read and change your browsing history.
• Read and modify data you copy and paste.
• Access all data on your computer.
• Detect your physical location.
• Identify and eject storage devices.
• Manage your apps, extensions, and themes.
• Communicate with cooperating native applications.
• Change your privacy-related settings.

The catch here is that the creators of malicious web browser extensions bank on users indiscriminately granting these permissions. Once you’ve given the green light, these rogue extensions can then:

• Access and steal your data: With permissions to read and modify data, these extensions can easily harvest sensitive information such as passwords, financial credentials, and confidential business documents.
• Spread malware: When an extension is allowed to access your local data, it can download additional harmful software, such as ransomware, without your consent.
• Disrupt your user experience: Notifications can be misused to bombard you with unwanted ads or even reroute you to phishing websites.
• Alter search results: With access to your browsing history and the ability to change settings, these extensions can manipulate your search results, directing you to unsafe websites.
• Hijack your homepage: Similarly, an extension that’s allowed to modify your web browser’s settings can easily replace your homepage with a different one to annoy you with ads or infect you with fileless malware.
• Erode privacy settings: By changing your privacy-related settings, a malicious extension can expose you to additional threats, making your system an easy target for cybercriminals.

So, while installing a new extension may seem like a fairly innocent task, the permissions granted during the installation process can have far-reaching implications for any organization’s cybersecurity posture.

Malicious Browser Extensions Are a Growing Problem

Malicious browser extensions aren’t some fringe cybersecurity issue that only a few unfortunate users encounter every year. It’s a growing trend that’s been evolving over time.

In 2022, McAfee reported on five malicious extensions redirecting users to phishing sites and tampering with eCommerce cookies. These extensions (Netflix Party, Netflix Party 2, FlipShope, Full Page Screenshot Capture, and AutoBuy Flash Sales) had a whopping install base of over 1.4 million.

Fast forward to May 2023, independent cybersecurity researcher Vladimir Palant unearthed a Chrome extension called PDF Toolbox. Despite its impressive user base of more than 2 million users and high ratings, the extension was caught loading arbitrary code from suspicious websites onto every webpage viewed by the user.

Things escalated further in July 2023. IBM Security Lab reported a spike in malicious Chrome extensions specifically targeting Latin America. These weren’t just random acts of cyber-vandalism; they focused on financial institutions, booking sites, and instant messaging services. IBM even identified a new malware, called Predasus, designed to inject malicious code via these rogue extensions.

What’s alarming about all of this isn’t just the increasing frequency but also the escalating sophistication. Bad actors are getting better at this game, exploiting the open architecture of web browsers and the naïveté of users. That’s why organizations need to take this threat seriously and integrate it into their broader cybersecurity strategies.

Safeguarding Against Malicious Browser Extensions

Taking proactive measures is crucial for minimizing the risks posed by malicious browser extensions. Fortunately, the implementation of a few cybersecurity controls is enough to greatly reduce the likelihood of falling victim to a cybersecurity incident caused by a malicious extension.

• Set up an extension installation policy: As the cornerstone of your defense, establish a policy that mandates IT approval for all browser extensions that employees wish to install. This vetting process will ensure that only secure and necessary extensions are in use.
• Invest in cybersecurity awareness training: Sometimes, the biggest vulnerability is a lack of awareness. Regularly conduct cybersecurity training sessions to keep everyone informed about the risks of malicious extensions and how to identify them.
• Keep your extensions updated: Outdated extensions can be a security risk. For example, the Chrome extension for the file-sharing service MEGA was hacked to steal login and cryptocurrency keys. Always update your extensions to benefit from the latest security patches.
• Avoid unofficial sources of extensions: Malicious extensions are often distributed through various third-party websites that have no review process in place to protect users. That’s why it’s always best to stick to downloading extensions from official stores like Chrome Web Store.
• Scrutinize permissions: Many extensions request a variety of permissions. Don’t just hit the Accept button. Instead, go through the list carefully. If an extension asks for more access than it needs for its stated function, that’s a red flag.
• Review installed extensions: Periodically review all installed browser extensions, removing those that are no longer needed or those you can’t recall installing.
• Use reliable endpoint protection software: Consider installing trusted endpoint protection software that offers real-time scanning and alerts for malicious browser activities.

The good news is that implementing these cybersecurity controls is not only effective but also straightforward, so their impact on day-to-day operations is minimal.

Conclusion

The bottom line is clear: malicious browser extensions are a pressing concern that demands immediate attention. Act now to review, restrict, and regularly update the browser extensions allowed within your organization.

Or better yet, contact us at OSIbeyond for a comprehensive security assessment and help with the implementation of the above-described cybersecurity controls. With our managed IT and cybersecurity services, you can focus on your business while we make sure that threats like malicious web browser extensions won’t compromise your organization’s security. Get in touch with OSIbeyond today.