Malicious browser extensions

MITRE T1176.001 covers extensions abused for persistent access. Extensions inherit permissions the browser already granted. A malicious one can capture what you type, passwords included.

Stolen cookies lead to session hijacking and cookie theft.

1. You install it from a store or a fake prompt.
2. It asks to read and change data on all sites.
3. It injects scripts, captures input, or copies cookies.
4. A later update can swap in malicious code.

Chrome shows permission warnings before you add an extension. Google's extension help says to approve only extensions you trust. Enhanced protection also flags extensions Safe Browsing does not trust.

1. Open Chrome and select More, then Extensions.
2. Choose Manage extensions.
3. On the extension, select Remove, then confirm.
4. For extensions you keep, open Details.
5. Set site access to On select or On specific sites.
6. Then sign out everywhere on accounts it could see.

Man-in-the-browser malware alters pages inside your own browser. It can alter what pages show and send. MITRE T1185 covers this as browser session hijacking. The attacker inherits your cookies and sessions.

Man-in-the-middle attacks intercept traffic on the network. Man-in-the-browser works after decryption, inside the browser. HTTPS does not stop it. Confirm new payees through a second channel.

• Store review misses some malicious or changed extensions.
• Teams approve extensions as productivity tools, then stop checking.
• Network tools cannot see what runs inside the browser.
• Permission prompts read like routine setup, so people click through.

• Allow approved extensions with ExtensionInstallAllowlist.
• Set ExtensionInstallBlocklist to * to block everything else.
• Remove extensions with all-sites access unless required.
• Review updates and ownership changes for approved extensions.
• Give high-risk roles a separate profile with few extensions.