Malicious and Privacy-Invasive Chrome Extensions Abusing Permissions for Data Collection and Affiliate Hijacking

New reporting and research highlighted escalating risk from Chrome browser extensions that present as AI productivity or shopping tools while collecting excessive data or performing hidden monetization. An Incogni analysis of 442 “AI-branded” Chrome extensions found more than half collected user data and nearly a third collected personally identifiable information (PII), based on requested permissions, developer disclosures, and risk scoring; the study flagged widely used tools as among the most invasive. Separately, Socket researchers identified a Chrome extension marketed as Amazon Ads Blocker that silently hijacked affiliate links, injecting the developer’s tag 10xprofit-20 into Amazon product URLs and replacing existing creator affiliate codes without user awareness.

Socket assessed the affiliate-hijacking behavior as part of a broader, likely coordinated ecosystem: at least 29 related extensions were observed targeting major e-commerce sites (including Amazon, AliExpress, Best Buy, Shopify, and Shein) using shared infrastructure and repeated policy-violating patterns, indicating intentional abuse rather than accidental noncompliance. In contrast, other contemporaneous items focused on broader consumer privacy guidance (e.g., smart TV tracking mitigations) or regulatory investigations into AI image generation on X/Grok; while privacy-adjacent, they do not describe the same Chrome extension abuse activity and are not directly actionable for extension-risk response beyond general awareness.