Loading story…
Security research attributed to Q Continuum reported 287 Chrome extensions that transmit users’ browsing history to third parties, affecting an estimated 37.4 million installations. The work used automated analysis (including containerized scanning and man-in-the-middle proxy inspection of extension traffic) to flag suspicious outbound communications consistent with URL/history leakage, and noted that some extensions use obfuscation and encryption (e.g., ROT47 and AES-256 with RSA key pairs) to conceal collection and exfiltration behavior.
The identified ecosystem includes extensions tied to data-broker/analytics activity, with reporting naming Similarweb and related entities (including “Big Star Labs”) among organizations operating extensions implicated in history collection, alongside other groups controlling additional high-install extensions. While some data sharing may be disclosed in privacy policies, the reporting emphasized that browsing history can be highly sensitive and, even when “anonymized,” can often be re-identified, creating material privacy and compliance risk for users and organizations that allow unmanaged browser extensions.
Trace attribution and downstream blast radius.
3 events from the most recent confirmed update back to the earliest known activity.
Subsequent coverage added that some extensions used plaintext, Base64, ROT47, AES-256, and RSA-based protection to conceal exfiltrated browsing data. Reports also highlighted risks such as deanonymization, exposure of internal corporate URLs and SaaS links, and possible credential or session-related abuse if additional browser data were collected.
The researcher disclosed an automated testing pipeline using Docker, Chromium, synthetic browsing, and a man-in-the-middle proxy to detect history leakage from extensions. The analysis named recipients and collectors including Similarweb, Big Star Labs, Semrush, Alibaba Group, ByteDance, Curly Doggo, and Offidocs, while noting roughly 20 million affected installs could not be tied to a known entity.
Security researcher Q Continuum reported finding 287 Google Chrome extensions that exfiltrate users' browsing history, affecting an estimated 37.4 million installations. The research said many extensions appeared benign while requesting access to history data and sending visited-URL information to third parties.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
5 references tracked. Mallory keeps watching after this page renders.
csoonline.com
Open sourcecsoonline.com
Open sourcehackread.com
Open sourcecybersecuritynews.com
Open sourcego.theregister.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers uncovered a coordinated campaign involving **108 malicious Chrome extensions** on the Chrome Web Store that collectively reached about **20,000 installs** and were published under **five separate publisher identities**. The extensions posed as legitimate tools and games but were tied to a shared command-and-control infrastructure, including `cloudapi[.]stream` and backend systems hosted at `144.126.135[.]238`. Investigators linked the operation through reused code, shared privacy-policy artifacts, common Google Cloud project numbers across **54 OAuth-enabled extensions**, and Russian-language comments, indicating a single operator or centrally managed service. The extensions were found stealing **Google account identity data**, **browsing information**, and **Telegram Web sessions**, while some also injected ads, inserted arbitrary JavaScript into visited pages, stripped security headers from sites such as YouTube, TikTok, and Telegram, or used a startup backdoor to open arbitrary URLs. The most severe sample, **Telegram Multi-account**, reportedly exfiltrated Telegram Web session data every 15 seconds and could enable full account takeover by replacing a victim's local session with attacker-supplied data. Researchers said the infrastructure appeared consistent with a **malware-as-a-service** model and warned that many of the extensions were still live when reported; affected users were urged to remove the extensions and revoke active Telegram Web sessions.
Jun 29, 2026
Investigations found that several popular Chrome and Edge extensions collected sensitive user data at scale, including AI chat conversations and browsing activity, often with limited transparency. Reports said extensions such as **Urban VPN**, Stylish, Poper Blocker, SimilarWeb, StayFocusd, CrxMouse, WhatRuns, and StayFree had either directly exfiltrated AI chat content or retained the remote-configurable capability to do so, affecting more than 7 million installs combined; a separate report alleged Urban VPN-related "privacy" extensions monetized data from roughly 8 million users. Researchers also reported that Urban VPN had previously scraped AI conversations and that its user-facing **opt-out of data collection** control was inverted in code, potentially leaving collection enabled even when users believed they had disabled it. Urban VPN was also found to contain a high-severity browser-extension flaw that let any website send privileged `postMessage` commands without origin validation, allowing attackers to disconnect the VPN, reroute traffic, change bypass settings, disable privacy protections, disable competing extensions, and query extension state. The issue was reportedly fixed in **Urban VPN version 5.12.5** by limiting accepted messages to a read-only query, while broader concerns about data collection practices remained. Together, the findings raised concerns that widely installed browser extensions marketed around convenience or privacy could both harvest sensitive content and expose users to direct manipulation of browser security controls.
Aug 21, 2026
Researchers uncovered a coordinated operation on the Chrome Web Store involving **152 “live wallpaper” new-tab extensions** spread across **38 publisher accounts** and three backend brands, with roughly **105,000 reported installs**. Built from a shared codebase, the extensions redirected install and uninstall traffic to operator-controlled infrastructure and monetized users through ad-driven destination pages including `tabplugins.com`, `yowgames.com`, `chromewallpaper.com`, and `owhit.com`. Investigators said the campaign functioned as an **adware-adjacent traffic-attribution fraud scheme**, not a remote-code-execution or classic search-hijacking operation. A **54-extension subset** used a newer template that forged **Google organic-search attribution** and disguised uninstall activity as legitimate search-result clicks, inflating the apparent value of referral traffic and polluting analytics. The extensions also contained an undisclosed service-worker routine that repeatedly attempted to delete `IndexedDB` data, a behavior researchers described as anti-forensic even though it did not appear to affect website data outside the extension origin and was ineffective against the campaign’s current local-storage state. The report also cited false Chrome Web Store privacy disclosures and minor data leakage through favicon requests for saved shortcut domains, highlighting ongoing abuse of the browser-extension ecosystem for stealthy ad-fraud operations.
Jul 12, 2026