Security researcher John Tuckner of Socket documented 319 Chrome extensions, collectively installed 13.4 million times, that silently override users' default search engine and reroute queries through proxy servers before landing on Bing or Yahoo. This builds on his April 2025 finding of 57 such extensions with 6 million users, adding 264 newly identified ones covering another 8.7 million installs. The extensions masquerade as PDF converters, search tools, and similar utilities, and are unlisted on the Chrome Web Store, spreading instead through ads on other websites.
bleepingcomputer.com
· 2026-10-29
Elastic Security Labs uncovered a malware toolkit called KREMLIN, active since mid-2025, that tricks victims into opening fake invoice or receipt files to install malicious Chrome and Edge extensions without any user approval. The toolkit recreates Chromium's cryptographic integrity checks so the browser treats the rogue extension as legitimate, then harvests login credentials, session tokens and other sensitive data. Elastic ties the operation to a Brazilian group that has run at least seven campaigns impersonating 12 banks since May.
bleepingcomputer.com
· 2026-09-16
An independent developer has published two small Chrome extensions aimed at everyday browsing tasks: one converts and displays Hebrew calendar dates, and another helps clean up or format Hebrew text. Both are offered free and can be installed directly from the Chrome extensions store.
chaimsapps.com
· 2026-09-10
Security firm Socket Inc. identified 19 malicious browser extensions for Chrome and Edge that operated for years before being caught. The most popular, a right-click/OCR utility, was installed by 80,000 combined users and secretly harvested cryptocurrency wallet data after receiving malicious updates roughly six months ago.
techspot.com
· 2026-09-02
GoKawiil