Research Identifies 287 Chrome Extensions Exfiltrating Users’ Browsing History

Security research attributed to Q Continuum reported 287 Chrome extensions that transmit users’ browsing history to third parties, affecting an estimated 37.4 million installations. The work used automated analysis (including containerized scanning and man-in-the-middle proxy inspection of extension traffic) to flag suspicious outbound communications consistent with URL/history leakage, and noted that some extensions use obfuscation and encryption (e.g., ROT47 and AES-256 with RSA key pairs) to conceal collection and exfiltration behavior.

The identified ecosystem includes extensions tied to data-broker/analytics activity, with reporting naming Similarweb and related entities (including “Big Star Labs”) among organizations operating extensions implicated in history collection, alongside other groups controlling additional high-install extensions. While some data sharing may be disclosed in privacy policies, the reporting emphasized that browsing history can be highly sensitive and, even when “anonymized,” can often be re-identified, creating material privacy and compliance risk for users and organizations that allow unmanaged browser extensions.