Security researcher John Tuckner of Socket documented 319 Chrome extensions, collectively installed 13.4 million times, that silently override users' default search engine and reroute queries through proxy servers before landing on Bing or Yahoo. This builds on his April 2025 finding of 57 such extensions with 6 million users, adding 264 newly identified ones covering another 8.7 million installs. The extensions masquerade as PDF converters, search tools, and similar utilities, and are unlisted on the Chrome Web Store, spreading instead through ads on other websites.
bleepingcomputer.com
· 2026-10-29
Researchers at Bay Area Labs say the Chrome extension Poper Blocker, which has over 2 million users and Google's 'Featured' and 'Established Publisher' badges, secretly collects browsing histories, screenshots and AI chatbot interactions. The extension uses code obfuscation and sandbox detection to avoid discovery, and the researchers say two other apps from the same developer, flagged as spyware nearly a decade ago, remain featured on the store. Bay Area Labs reported Poper Blocker to Google in May 2026 but says no action has been taken.
darkreading.com
· 2026-09-28
Google has completed its long-planned phase-out of Manifest V2 by removing all remaining MV2 extensions from the Chrome Web Store, including the popular ad blocker uBlock Origin. Extensions already installed on Chrome 138 or earlier will keep working but can no longer receive updates or be reinstalled once removed. Because the Chrome Web Store also serves other Chromium-based browsers, the removal affects users beyond Google Chrome itself.
webiterate.dev
· 2026-08-31
Security firm Socket uncovered a campaign, active since early 2024, in which 16 malware modules were pushed through browser extensions on the Chrome Web Store and Microsoft Edge add-ons store. Five extensions were initially legitimate but were bought from their original developers and later turned malicious via automatic updates, including one tool with roughly 70,000 Chrome users and 10,000 Edge users. Once activated, the extensions connected to remote servers to strip website security headers, inject phishing scripts, and drain cryptocurrency wallets on platforms like Coinbase, Binance, Kraken and MetaMask.
bleepingcomputer.com
· 2026-08-30
The uBlock Origin team has released version 1.74, which it says will be the last stable build available on the Chrome Web Store. Google plans to pull the extension from the store on August 31 as it finishes phasing out support for Manifest V2, the older extension platform uBlock Origin relies on. Chrome users searching the store are already seeing only the Manifest V3-based uBlock Origin Lite as a replacement.
androidauthority.com
· 2026-08-26
GoKawiil