Millions of users have fallen victim to malicious browser extensions because of a critical flaw, but things are changing here's what you need to know

Date:
Fri, 01 Aug 2025 21:37:00 +0000

Description:
Browser extensions continue to pose risks due to weak analysis tools and
false trust markers, prompting researchers to rethink how extension behavior is evaluated.

FULL STORY ======================================================================Labels like Verified give a false sense of safety but dont reflect real extension behavior Browser DevTools were never meant to track how extensions behave across tabs and over time Malicious extensions often act normally until specific triggers make their hidden features come alive

The unchecked spread of malicious browser extensions continues to expose
users to spyware and other threats, largely due to deep-seated flaws in how the software handles extension security.

New research from SquareX claims many people still rely on superficial trust markers like Verified or Chrome Featured, which have repeatedly failed to prevent widespread compromise.

These markers, while intended to reassure users, often offer little insight into the actual behavior of an extension. Labels offer little protection against dynamic threats

A central issue lies in the limitations of Browser DevTools, which were designed in the late 2000s for web page debugging.

These tools were never meant to inspect the far more complex behavior of modern browser extensions, which can run scripts, take screenshots, and operate across tabs, actions that existing DevTools struggle to trace or attribute.

This creates an environment where malicious behaviors can remain hidden, even as they collect data or manipulate web content.

The failure of these DevTools lies in their inability to provide telemetry that isolates extension behavior from standard web activity.

For instance, when a script is injected into a web page by an extension, DevTools lack the means to distinguish it from the pages native functions.

The Geco Colorpick incident offers an example of how trust indicators can
fail catastrophically - according to findings from Koi Research, 18 malicious extensions were able to distribute spyware to 2.3 million users, despite carrying the highly visible Verified label.

To address this, SquareX has proposed a new framework involving a modified browser and what it calls Browser AI Agents.

This combination is designed to simulate varied user behaviors and
conditions, drawing out hidden or delayed responses from extensions.

The approach is part of what SquareX terms the Extension Monitoring Sandbox,
a setup that enables dynamic analysis based on real-time activity rather than just static code inspection.

At the moment, many organizations continue to rely on free antivirus tools or built-in browser protections that cannot keep up with the evolving threat landscape.

The gap between perceived and actual security leaves both individuals and companies vulnerable.

The long-term impact of this initiative remains to be seen, but it reflects a growing recognition that browser-based threats demand more than superficial safeguards. You might also like Google Workspace is copying a very familiar YouTube feature to help you get through videos Check out the best AI phones
on the market Here is our list of the best AI website builders on the web



======================================================================
Link to news story: https://www.techradar.com/pro/millions-of-users-have-fallen-victim-to-maliciou s-browser-extensions-because-of-a-critical-flaw-but-things-are-changing-heres- what-you-need-to-know


--- Mystic BBS v1.12 A49 (Linux/64)
* Origin: tqwNet Technology News (1337:1/100)