extuno
How do malicious browser extensions work?
Users grant an extension broad access at install: read pages, read cookies, read requests. A malicious extension uses that access to steal data or inject content. The dangerous ones often start clean and turn malicious in a later update.
What access does an extension actually have?
With host permissions like <all_urls>, an extension can read and change every page you visit. A content script runs in the page and can read forms, cookies, and the DOM. The background service worker handles events and network calls. A password manager needs that access. So does a stealer.
How do malicious extensions evade review?
Manifest V3 forbids remotely hosted code, but attackers smuggle it back: fetching instructions on a timer and evaluating them, or stripping Content-Security-Policy through declarativeNetRequest to allow injection. Others ship clean, pass review, and add the payload in a later update.
The December 2024 Cyberhaven incident is the template: an OAuth consent phishing email compromised a developer's Chrome Web Store access, and a trojanized update exfiltrated cookies and session tokens from users who had already trusted the extension.
What do malicious extensions steal?
Session cookies and auth tokens (to hijack accounts without a password), keystrokes and form data, browsing history and open tabs. Wallet approvals and seed phrases if the victim holds crypto. Some inject ads or affiliate codes; some mine cryptocurrency in the background.
How does Extuno detect a malicious extension?
Extuno unpacks and analyzes every version with 1100+ static rules, runs it in a sandbox to capture real network and API behavior, and diffs each release against the one before it. If an extension that scanned clean starts beaconing, the finding names the file, the endpoint, and the payload.