A wave of malicious Chrome and Edge extensions has been discovered, exposing millions of users to the risk of wallet-stealing and crypto-draining attacks. The extensions, which have been downloaded over 30 million times, were found to contain code that exploits vulnerabilities in popular web applications, allowing hackers to drain cryptocurrency wallets and steal sensitive user data.
The malicious extensions were created using a technique called cross-domain privilege escalation, which allows developers to bypass security restrictions and access sensitive information on other websites. This vulnerability is particularly concerning because it can be exploited even if users have taken basic precautions such as enabling two-factor authentication or using strong passwords. By creating an extension that appears legitimate but contains malicious code, hackers can deceive users into granting them access to their wallet and other sensitive data.
At least 19 Chrome and Edge extensions were found to contain the malicious code, including popular add-ons for password management, social media monitoring, and cryptocurrency tracking. The extensions were discovered by a team of researchers who used advanced tools to scan through millions of lines of code and identify patterns that indicated potential vulnerabilities. Once installed on a user’s browser, the malicious extension can create a backdoor to the wallet or other sensitive data, allowing hackers to access it remotely.
The impact of this vulnerability is significant because it affects not only individuals but also businesses and organizations that rely on web applications for financial transactions. A single breach could result in substantial financial losses, damage to reputation, and compromised customer trust. Furthermore, the fact that these extensions were downloaded millions of times suggests that many users are unknowingly exposing themselves to this risk.
The discovery of these malicious extensions highlights the importance of vigilance when it comes to browser add-ons and web applications. Even legitimate-looking extensions can contain hidden vulnerabilities or malware, making it essential for users to regularly review their installed extensions and report any suspicious activity to the developer or relevant authorities. Additionally, developers should prioritize security testing and code reviews to prevent such incidents in the future.
To protect yourself from these types of attacks, be cautious when installing new browser extensions, especially those that claim to offer financial services or access sensitive data. Regularly review your installed extensions, check for updates, and enable two-factor authentication whenever possible.
Source: The Hacker News — 2026-08-28