Browser Extension Security Explained: Why Trusted Extensions Turn Malicious and How Companies Control Them

Most people install a browser extension once and never think about it again. That is exactly what makes extensions attractive to attackers: they run inside every website the user opens, after login and after encryption, and they update themselves.

What an extension can reach

Extensions declare permissions when they are installed. Host permissions decide which sites the extension's scripts can run on; "read and change all your data on all websites" means every page, including email, CRM, code hosting and cloud consoles. Further permissions add access to cookies, network requests, tabs and scripting. An extension with broad access sees everything the user sees and can act as the user in any session they have open.

How trusted extensions turn

There are three common paths to a malicious update:

• Developer account phishing. In December 2024 an attacker phished an employee of the security company Cyberhaven with an email that appeared to come from the Chrome Web Store, gained publishing access through a malicious OAuth app, and pushed a malicious version of Cyberhaven's extension. It was live for roughly a day over 25 and 26 December (UTC) and targeted logged-in sessions for an advertising platform. Researchers later linked the same campaign to more than 30 other extensions.
• Ownership change. Popular extensions are bought, and new owners ship monetisation or malware to the existing users. Research in 2025 described long-trusted extensions, some with featured or verified badges, that turned malicious years after publication.
• Build compromise, as with any software supply chain.

Manifest V3, which Chrome completed moving to in 2025, bans remotely hosted code so reviewers see what runs. It does not stop a reviewed update from carrying malicious code that was in the package.

How companies control extensions

Chrome and Edge both support managed policies. The core pattern:

1. Default deny with an allowlist by extension ID, with a fast request process so people do not move to unmanaged browsers.
2. Block by permission, refusing extensions that ask for high-risk permissions unless explicitly approved.
3. Runtime host restrictions: Chrome's runtime_blocked_hosts stops extensions injecting scripts or reading cookies on listed sites, so even an allowed extension cannot touch the identity provider, admin consoles or finance systems.
4. Managed browsers for work, enforced through conditional access, so personal profiles full of unreviewed extensions do not hold work sessions.
5. Inventory and monitoring of installed extensions, versions and permissions, with alerts on permission changes and on extensions flagged by threat intelligence.

When an extension turns

Remove it centrally by ID, confirm removal from inventory, and treat the sessions of everyone who had the malicious version as stolen: revoke them for the affected services, check sign-in logs for use from new devices, and look in proxy logs for traffic to the exfiltration domain. Emailing staff to uninstall it is too slow.

If you publish an extension

Your store developer account is a production credential with reach into every user's browser. Use phishing-resistant MFA, keep the number of publishers small, review OAuth apps granted access to the account, and stage rollouts where the store allows.

Go deeper

The full scored answer with a what-if ladder is browser extension security. Extensions and infostealers target the same prize, which is covered in the infostealer economy and infostealers and session theft.