Threat playbook

Malicious browser extensions in the browser

Malicious browser extensions abuse browser permissions to steal data, hijack sessions, inject ads, or redirect users to phishing pages.

Quick answer

Extensions sit inside the browser’s trust boundary: a single rogue extension can see what users see, capture inputs, and tamper with web sessions.

For drive-by content and risky downloads, isolation keeps untrusted web execution off the endpoint and makes each browsing session disposable.

2026-01-29

A user installs an extension from a store, a download page, or a “required to view content” prompt.
The extension requests broad permissions (read/modify all sites, access clipboard, manage downloads).
It injects scripts into pages, captures credentials, steals cookies/tokens, or manipulates content.
Some extensions start benign and turn malicious after an update or a change in ownership.

Extensions are often treated as “productivity tools,” so approvals become lax over time.
Store vetting is imperfect; malicious or compromised extensions can persist for long periods.
Network security can’t always see what an extension does inside the browser context.

Isolation reduces the impact of untrusted browsing even when endpoints are exposed to web content, but extension control remains crucial.
A strong isolation program pairs well with strict extension allowlists and policy enforcement.
Disposable sessions reduce the persistence of risky browsing state, though extensions installed locally remain a separate risk to manage.

Enforce an extension allowlist via Chrome Enterprise policy; block user installs by default.
Review extensions for broad permissions; remove “read and change all data” unless truly required.
Audit extension updates and ownership changes; treat them as security events for privileged environments.
Use isolated browsing for unknown sites and ad-driven traffic to reduce exposure to extension-triggered redirects and payloads.
For high-risk roles, use separate browser profiles with minimal extensions.

Are extensions from official stores safe?

Safer than random downloads, but not automatically safe. Stores can miss malicious behavior and extensions can change over time.

What permissions are most risky?

Broad “read and change data on all websites,” access to clipboard, and ability to manage downloads or network requests are high risk.

Can isolation replace extension management?

No. Isolation protects against untrusted web content; extension risk lives on the endpoint and needs policy controls and allowlists.

What’s a quick win?

Block user-installed extensions by default and approve a small allowlist that is reviewed regularly.