We tell people to be careful which browser extensions they install. Check the reviews, look at the permissions, prefer the ones with a name behind them. It is good advice, and it quietly assumes something that is not true: that the extension you install is the extension you keep.
It is not. Extensions auto-update, silently, in the background, from whoever controls the listing today - which is not necessarily whoever controlled it when you decided to trust it. The thing you vetted and the thing running in your browser next Tuesday can be two different programs, and nothing in the browser asks you again. The update channel, not the install, is the attack surface, and 2026 has been a long demonstration of it.
What actually happened, in one extension
In December 2025, OX Security flagged a Chrome extension called "AI Sidebar with DeepSeek, ChatGPT, Claude and more" for scraping ChatGPT and DeepSeek conversations and sending them to external domains. By then it had over 300,000 installs and a 4.6-star rating. Google pulled it in January 2026.
It came back. By August 2026 it was in the Chrome Web Store again, and Netskope Threat Labs caught a new version, 1.7.3.0, arriving through Google's own CDN between 20 and 31 July. The new payload was not stealing chats this time; it was monetizing the user. As Netskope described it, when Chrome reports that the extension has updated, a service worker opens an affiliate link in a foreground tab, routed through a URL shortener to an AI video platform. It went further: it exploited a Chrome quirk where the uninstall URL can be overwritten, so the extension earned an affiliate commission even as you removed it. It got paid on the way out.
Nobody who had this installed did anything wrong. They installed a popular, well-reviewed tool, and an update turned it into something else while they were not looking. That is the whole problem in one story.
Why the update is the soft spot
An extension is not a static download. It is a listing with an owner, and two things about that owner change over time in ways the store does not surface to you.
Ownership transfers. An extension with a real userbase is an asset, and assets get sold. A developer who built something useful, got tired of maintaining it, and sold the listing to a buyer they never met has just transferred your trust to a stranger, and you will never see the transaction. Security firm Socket documented a wave of this in 2026: extensions acquired from their original creators and then, via ordinary automatic updates, injected with code to steal credentials and cryptocurrency. The users had vetted the original authors. The original authors were gone.
Updates ship without re-review of the thing you agreed to. You granted permissions once, to a version of the code you never read, and every version after it inherits those permissions. An extension with "read and change all your data on all websites" - a permission a great many legitimate extensions genuinely need - does not have to ask again to start doing something new with it. The consent was for the permission, not for any particular use of it, and an update is a new use.
Manifest V3, which was supposed to be the big security reset, does not close this. It reworked how extensions run background code and it made some classes of remote code harder, but a service worker opening an affiliate tab on update is perfectly ordinary MV3, and so is exfiltrating data an extension is already permitted to read. MV3 changed the plumbing, not the trust model.
What this means if you use extensions
There is no browser setting that fixes a supply-chain problem, so the defenses are all about reducing exposure rather than detecting the bad update, which you cannot reliably do.
- Run fewer of them. Every extension is a listing that can change hands, and the set you run is both your attack surface and, incidentally, a fingerprint a page can read. Uninstall the ones you stopped using; a dormant extension still updates.
- Separate profiles by risk. Keep the extension-heavy profile away from the one you bank and work in. A profile with three extensions is a smaller target than one with thirty, and a compromise in one does not sit in the same browser as your session cookies in the other.
- Watch for the tells of a sold listing: a sudden update after a long quiet period, a change of developer name or support domain, new permissions requested on update, a once-focused tool that grows features nobody asked for. None of these is proof, and all of them are worth a second look before you keep it.
What it means if you build them
The uncomfortable half: the trust your users place in you is transferable, and the store makes it easy to transfer. If you sell a listing, you are selling their trust to whoever buys it, and they will not be told. That is worth a moment's thought before the sale, and an honest note to your users is worth more than the extra few percent a buyer will pay for a silent handover.
And if you are shipping updates: the permissions you were granted are a loan, not a licence. Every update is a chance to quietly widen what you do with data you were trusted to touch for one narrow reason. The users cannot see the diff. That asymmetry is exactly what the bad actors are exploiting, and it is the reason the whole category is under suspicion it did not used to be.
Chrome Web Store enforcement did tighten in 2026 - stricter data-collection rules, closer review of whether an extension's privacy disclosures match its actual behavior, faster removals. It helps at the edges. But review happens at submission, and the attack happens at update, from an owner who looks legitimate because, until recently, they were. The gap between "I vetted this" and "this is what is running" is structural, and closing it is mostly on the two groups least inclined to think about it: the users who install and forget, and the authors who ship and move on.
If you write extensions, the kindest thing you can do for the people who trusted you is to keep deserving it on every update - and, if you ever stop, to tell them rather than sell them.
Top comments (0)