A fresh wave of malicious Chrome and Edge extensions has surfaced, putting millions of users’ sensitive financial information at risk. A total of 19 suspicious extensions, available for download from both the Google Chrome Web Store and Microsoft Edge Add-ons, have been found to contain wallet-stealing and crypto-draining code.
These extensions, which claim to offer various functionalities such as password management, browser optimization, and cryptocurrency tracking, are designed to deceive users into granting them excessive permissions. Once installed, they can access sensitive data, including credit card numbers, login credentials, and even cryptocurrency wallets. The most alarming aspect of this incident is that the malicious code has been able to evade detection by major antivirus software.
So how does it work? These extensions employ a clever tactic known as cross-domain privilege escalation, which allows them to bypass traditional security measures. By exploiting vulnerabilities in browser architecture, they can gain access to sensitive data across multiple domains and then proceed to steal or drain funds from compromised accounts. This sophisticated technique has made it difficult for users to detect the malicious activity until it’s too late.
The affected extensions have been downloaded millions of times worldwide, making this a significant threat to online security. Users who have installed these extensions are advised to remove them immediately and change their passwords as a precautionary measure. Furthermore, it is crucial for developers to implement robust security measures to prevent such incidents in the future.
In recent years, we’ve seen an increasing trend of malicious browser extensions being used for various nefarious purposes. This incident highlights the importance of staying vigilant and regularly monitoring the extensions installed on our devices. By doing so, we can minimize the risk of falling victim to these types of attacks.
For users, a practical takeaway from this incident is to be extremely cautious when installing browser extensions, especially those that claim to offer sensitive functionalities such as password management or cryptocurrency tracking. Only download extensions from trusted sources and carefully review their permissions before granting them access to your data. Regularly reviewing and updating your security software will also help detect and prevent similar incidents in the future.
Source: The Hacker News — 2026-08-28