{"id":101226,"date":"2024-08-07T00:53:20","date_gmt":"2024-08-07T07:53:20","guid":{"rendered":"https:\/\/www.intego.com\/mac-security-blog\/?p=101226"},"modified":"2025-04-25T10:20:15","modified_gmt":"2025-04-25T17:20:15","slug":"chrome-extensions-are-a-security-nightmare-heres-why-you-should-avoid-them","status":"publish","type":"post","link":"https:\/\/www.intego.com\/mac-security-blog\/chrome-extensions-are-a-security-nightmare-heres-why-you-should-avoid-them\/","title":{"rendered":"Chrome extensions are a security nightmare; here’s why you should avoid them"},"content":{"rendered":"

\"\"<\/p>\n

For decades, popular Web browsers have offered the ability to extend their capabilities through the use of third-party extensions.<\/p>\n

Today, Google Chrome is the most popular desktop browser on the planet, with a roughly 65% market share<\/a>. Microsoft Edge is the number-two browser, with a 13% market share, and it’s also based on Chromium\u2014the open-source version of Chrome. These and other Chromium-based browsers support extensions from Google’s Chrome Web Store<\/a>.<\/p>\n

Malware in Google’s Chrome Web Store<\/h3>\n

Google would have you believe that Chrome extensions are, by and large, extremely safe. On June 20, the Chrome Security Team wrote<\/a> on the Google Security Blog, that “In 2024, less than 1% of all installs from the Chrome Web Store were found to include malware<\/strong>,” noting “We’re proud of this record.”<\/p>\n

It seems odd to be “proud” that close to 1 in every 100 extension installs from their store contains malware. Imagine a doctor bragging to patients, “Only 1 in 100 patients gets sick as a result of visiting our office!” That’s an alarming failure rate.<\/p>\n

Also concerning is that Google’s claim presumably* didn’t even take into consideration an August 6 report<\/a> about “at least 300,000 users across Google Chrome and Microsoft Edge” who had unknowingly installed extensions from a specific malware campaign over the past three years. (*The exact timeline of communication between the researchers and Google is unclear.)<\/p>\n

Extension risks go far beyond malware<\/h3>\n

Two days before the Google blog post, researchers from Stanford University published a study<\/a> examining the safety of extensions in the Chrome Web Store (CWS). Most of their sample data was collected through May 2023. But the results may reflect a somewhat similar situation to today’s Chrome Web Store\u2014and they’re shocking.<\/p>\n

The researchers defined “security-noteworthy extensions” (SNE)<\/strong> as malware-containing, privacy-violating, or known-vulnerable extensions. And they found many of each.<\/p>\n

Some of the key takeaways from the research include:<\/p>\n