Loading story…
Researchers have detailed a method to silently load arbitrary extensions into Chromium-based browsers on Windows domains by manipulating internal preference files and their cryptographic integrity checks. This technique bypasses standard installation methods and enterprise policies, enabling full browser compromise and persistent access to sensitive data. Defensive recommendations include monitoring for unauthorized changes to browser preference files and registry keys related to extension policies.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Initial story creation
5 references tracked. Mallory keeps watching after this page renders.
go.theregister.com
Open sourcedarkreading.com
Open sourcescworld.com
Open sourcesynacktiv.com
Open sourcedispatch.thorcollective.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A serious unpatched **Chromium** vulnerability was accidentally exposed after Google engineers marked the issue as fixed without shipping a patch, causing the bug report and proof-of-concept to become public. The flaw, originally reported in 2022, abuses the **Background Fetch API** to keep a Service Worker and malicious JavaScript running after the browser is closed and, in some cases, even after a device reboot. Affected products include **Chrome**, **Microsoft Edge**, **Brave**, **Opera**, **Vivaldi**, and **Arc**. The bug could let attackers abuse victims’ browsers for proxying traffic, launching DDoS activity, opening websites, and tracking user behavior; Google later re-hid the report and said it is working on a fix. Separately, researchers analyzing the **VoidStealer** infostealer found it can bypass Chrome’s **Application-Bound Encryption (ABE)** on Windows by attaching to the browser as a debugger, intercepting the moment Chrome decrypts protected data, and extracting the master key from memory. That technique enables theft of cookies, sessions, and other sensitive browser data, and the risk extends to other Chromium-based browsers using the same protection model. Together, the disclosures show that Chromium ecosystems face both browser-level persistence abuse and post-compromise data theft, with defenders urged to watch for unusual download-menu behavior, keep browsers updated as fixes arrive, and harden endpoints against infostealer activity.
Jun 29, 2026
Researchers reported multiple **malicious browser extension** campaigns abusing official add-on ecosystems to steal data and hijack accounts. One operation tracked as **GhostPoster** hid malicious logic inside seemingly benign PNG image files, a technique used to evade typical extension review and static checks; follow-on infrastructure analysis linked the activity to at least **17 additional extensions** using the same backend and tactics, with **~840,000 installs** and some extensions active for up to **five years**. The campaign reportedly started on **Microsoft Edge** and later expanded to **Chrome and Firefox**, emphasizing stealth and long-term persistence over rapid spread. Separately, Socket researchers identified **five malicious Chrome extensions** impersonating enterprise platforms (*Workday, NetSuite, SuccessFactors*) to enable **session hijacking and account takeover**. The extensions were described as working together to **steal authentication tokens/cookies**, **block incident response** by manipulating the DOM to interfere with security administration pages, and perform **cookie injection** to take over sessions; most were removed from the Chrome Web Store but remained available via third-party download sites. In response to the broader extension abuse, **Mozilla and Microsoft** removed identified add-ons from their marketplaces, but already-installed extensions remain a risk and require **manual removal**.
Jun 29, 2026
A researcher disclosed a "universal code execution" attack pattern in browser extensions in which a malicious website sends crafted `window.postMessage` data to a content script that forwards it to a privileged extension background process. Extensions that inject content scripts broadly and fail to validate message origins can expose privileged capabilities to arbitrary websites, including cross-origin cookie access and same-origin policy bypasses. The impact can escalate to operating-system command execution when the extension relays attacker-controlled data through Chrome native messaging to an unsafe native host. The researcher identified the pattern through extension-manifest analysis and Semgrep taint tracking, and reported two censored, allegedly unpatched cases affecting large user populations; one smart-card extension with roughly two million users reportedly allowed a malicious DLL to be loaded through path traversal in a PKCS#11 library path. Organizations should assess extensions for strict content-script scope, origin and schema validation on message-passing interfaces, and hardened native-message handling.
Sep 3, 2026