A Study on Malicious Browser Extensions in 2025

1st Shreya Singh 2nd Gaurav Varshney 3rd Tarun Kumar Singh 4th Vidhi Mishra
Department of CSE, IIT Jammu Department of CSE, IIT Jammu Department of CSE, IIT Jammu Department of CSE, IIT Jammu
Jammu, India Jammu, India Jammu, India Jammu, India
[email protected] [email protected] [email protected] [email protected]

Abstract—Browser extensions are additional tools developed keylogging, spying, data theft, and session hijacking [16].
by third parties that integrate with web browsers to extend This dual nature—offering benefits while posing signifi-
their functionality beyond standard capabilities. However, cant risks—has made browser extensions a critical focus
the browser extension platform is increasingly being ex- of cybersecurity research.
ploited by hackers to launch sophisticated cyber threats. This paper aims to study and experimentally validate
These threats encompass a wide range of malicious activities, the inherent malicious capabilities of browser extensions,
arXiv:2503.04292v1 [cs.CR] 6 Mar 2025

including but not limited to phishing, spying, Distributed with a particular focus on Mozilla Firefox and Chrome,
Denial of Service (DDoS) attacks, email spamming, affil- the world’s most widely used browser [1]. By analyzing
iate fraud, malvertising, and payment fraud. This paper real-world examples and examining attack techniques em-
examines the evolving threat landscape of malicious browser ployed by malicious extensions, the study highlights the
extensions in 2025, focusing on Mozilla Firefox and Chrome. evolving threat landscape posed by browser extensions in
Our research successfully bypassed security mechanisms of the year 2025. The experiments and findings presented in
Firefox and Chrome, demonstrating that malicious exten- this paper are designed to assist internet researchers and
sions can still be developed, published, and executed within users in understanding these threats, while also guiding the
the Mozilla Add-ons Store and Chrome Web Store. These industry toward the development of effective controls and
findings highlight the persisting weaknesses in browser’s vet- countermeasures to mitigate risks associated with browser
ting process and security framework [1]. It provides insights extensions.
into the risks associated with browser extensions, helping Ultimately, this research underscores the critical need
users understand these threats while aiding the industry in for secure practices and policies to protect against browser
developing controls and countermeasures to defend against extension attacks. It also emphasizes the importance of
such attacks. All experiments discussed in this paper were striking a balance between providing APIs for extended
conducted in a controlled laboratory environment by the functionality and addressing the security risks they intro-
researchers, adhering to proper ethical guidelines. The sole duce, which can often go undetected. While this study
purpose of these experiments is to raise security awareness focuses on Google Chrome and Mozilla Firefox, most
among the industry, research community, and the general modern browsers, including Microsoft Edge, Safari, sup-
public. port extensions built on standardized APIs. Many of the
attack techniques explored in this paper could be adapted
Index Terms—Browser Extensions, Malicious Browser Ex- to other browsers, suggesting a broader industry-wide risk.
tensions, Attacks due to Extensions.

1.1. Browser Extensions

1. Introduction
The rapid evolution of web browsers has transformed Browser extensions [2], [3], developed by third-party
them from simple tools for accessing websites into sophis- creators, enhance browser functionality by adding diverse
ticated platforms that support a wide range of functional- features. However, they also present significant security
ities. Modern browsers such as Google Chrome, Mozilla risks, as malicious actors exploit them to carry out so-
Firefox, and Microsoft Edge not only enable seamless web phisticated attacks, including phishing, spying, DDoS,
browsing but also offer features like bookmarks, history email spamming, affiliate fraud, malvertising, and pay-
tracking, and built-in security enhancements. However, ment fraud. This paper investigates the vulnerabilities of
users often demand additional capabilities that extend current browsers, with a focus on Mozilla Firefox and
beyond these native features, driving the widespread adop- Google Chrome due to its widespread use and popularity.
tion of browser extensions. These extensions, developed It explores the technical weaknesses in the extension
by third parties, allow users to customize and enhance platform that attackers leverage to execute such mali-
their browsing experiences, providing tools such as ad cious activities. By analyzing these vulnerabilities, the
blockers, password managers, and productivity boosters. study highlights potential improvements, such as enhanced
Despite their utility, browser extensions represent a vetting processes for extensions, increased user aware-
double-edged sword. While they significantly enhance ness, and stronger security protocols within browsers.
user convenience, they also introduce numerous security Implementing these measures can mitigate risks, enhance
vulnerabilities. Malicious actors exploit browser exten- browser security, and ensure a safer browsing experience
sions to execute sophisticated attacks, including phishing, for users.
1.2. Malicious Browser Extension Based Attacks examined methods to induce and identify malicious behav-
ior by probing unauthorized data access and page content
MBEs are third-party add-ons that exploit browser tampering. Shahriar et al. [31] proposed a hybrid approach
APIs to perform unauthorized actions such as data theft, that monitors API calls and user interactions to detect
spying, content manipulation, and session hijacking. In- both known and unknown threats. Pantelaios et al. [32]
creasingly, these extensions, often disguised as produc- developed a method based on analyzing code update deltas
tivity tools, enable attacks including keylogging, data ex- to flag potentially harmful modifications, while Moreno et
filtration, malicious code injection, and session hijacking. al. [34] critically assessed the Chrome Web Store’s vetting
Early MBEs (2013–2015) primarily focused on basic data process, revealing that techniques like repackaging and
theft—keylogging (e.g., HoverZoom, 2013) and activity obfuscation can allow malicious extensions to bypass both
tracking (e.g., BBC News Reader, 2014)—eroding user automated and manual reviews. Despite advancements
trust. By 2016, attackers employed more advanced tech- such as Manifest V3 and sophisticated machine-learning
niques such as web request interception (e.g., iCalc, 2016) scans, evasion strategies like delayed execution and per-
and token theft via phishing (e.g., Viralands, 2016). From mission escalation remain effective, highlighting the need
2017 onward, MBEs adopted complex payloads for finan- for stricter sandboxing, refined permission models, and
cial and operational exploitation, including ad fraud (e.g., real-time monitoring.
Web Developer, 2017) and proxy-based traffic manipula-
tion (e.g., Dubbed Copyfish, 2017). Recently, supply chain 3. Advancements and Limitations in Browser
attacks (e.g., Cyberhaven, 2024) have emerged, where Extension Security (2012–2024)
adversaries compromise trusted developer accounts using
social engineering and OAuth token abuse to deploy mali- From 2012 to 2024, major web browsers, including
cious updates. Table 1 summarizes notable MBE incidents Google Chrome and Mozilla Firefox, have made signifi-
from 2013 to 2024, illustrating the shift from opportunistic cant advances in improving extension security to combat
attacks to coordinated, high-value campaigns exploiting persistent threats posed by malicious browser extensions.
browser vulnerabilities. Initially, both Chrome and Firefox allowed extensive ac-
cess to browser APIs, making it easier for attackers to
exploit vulnerabilities for data theft, phishing, and mal-
2. Literature Review on MBEs ware injection [12], [13]. In response to growing threats,
Google introduced Manifest V3 (MV3) in 2018, impos-
Malicious browser extensions (MBEs) increasingly ing stricter permission requirements, reducing access to
threaten user privacy by masquerading as benign produc- sensitive APIs, and replacing the Web Request API with
tivity tools while covertly stealing data, injecting ads, or a more restrictive Declarative Net Request (DNR) API.
hijacking sessions. Studies such as ParaSiteSnatcher [4] These measures aimed to limit data abuse by malicious
and Cyberhaven’s Chrome extension [5], [8] illustrate the extensions while maintaining essential functionality [16],
multifaceted impact of these threats. Varshney et al. [13] [18]. Additionally, Google improved its Chrome Web
demonstrated that the inherent access to sensitive browser Store review process by implementing automated and
APIs enables attackers to execute phishing, spying, DDoS, manual checks to detect malicious behavior before pub-
email spamming, and affiliate fraud. This vulnerability is lication [14]. Mozilla Firefox, on the other hand, refined
further examined in [15], which highlights how Chrome’s its WebExtensions API, enforcing stricter sandboxing and
open extension platform facilitates cyberfraud and cyber- requiring explicit user consent for sensitive permissions.
spying. Chang and Chen’s work [16] emphasizes the risks Unlike Chrome, however, Firefox does not enforce a com-
of runtime information leakage from extensions, while plete transition to an MV3-like model, keeping the Web
Maunder [33] reveals that millions of malicious extensions Request API accessible, which allows developers greater
can operate undetected. At DEF CON 32, SquareX [25] flexibility but also introduces security risks.
showed that even with Google’s Manifest V3 framework, Other browsers, including Microsoft Edge and Sa-
MBEs can bypass security measures, stealing live streams, fari, have aligned their security models with Chrome and
cookies, and user credentials. Collectively, these studies Firefox, adapting their extension frameworks to balance
underscore the need for enhanced detection strategies and security and developer accessibility. Microsoft Edge, built
stricter controls, as the evolving threat landscape suggests on Chromium, follows Chrome’s MV3 policies, benefiting
that MBEs will continue to pose significant risks into from the same security updates. Safari has focused on pri-
2025. vacy protections by enforcing stricter permission requests
Several studies have proposed techniques to detect and and isolating extensions to limit their access to user data.
mitigate malicious browser extensions. Wang et al. [27] Despite these advancements, malicious browser extensions
introduced a machine-learning model that combines static continue to evade detection through sophisticated tech-
and dynamic analyses of JavaScript, HTML, and CSS niques. Extensions often obscure their true intent using
to classify extensions with over 95% accuracy. Kaushik obfuscated code or delay activation of malicious behavior
et al. [28] advocate for continuous monitoring through until after review [25]. Cybercriminals frequently update
enhanced permission management, API tracking, and real- extensions with malicious code or republish previously
time behavior analysis to preemptively block harmful removed extensions under new names, bypassing detection
extensions. Varshney and Misra [29] revealed a phishing mechanisms [26]. While Chrome’s MV3 restricts API
vector called Browshing, where extensions mimic legiti- access, Firefox’s more permissive approach allows for
mate sites to steal sensitive information, underscoring the broader functionality, which can be exploited by malicious
need for targeted phishing detection. Kapravelos et al. [30] extensions.
 TABLE 1. M ALICIOUS E XTENSION BASED ATTACKS (2013-2024) [6], [7], [5], [8], [9], [10], [13], [26]

Extension (Year) Attack Type Description

HoverZoom (2013) Keylogging Browse images on websites by hovering. Collecting online form data
and selling users’ keystrokes.
Tweet This Page (2014) Content Injection Tweet a Page. Turned into an ad-injecting machine; started hijacking
Google searches.
BBC News Reader (2014) Spying Get latest news and articles. Tracks user browsing data.
Autocopy (2014) Spying Select text and automatically copy to the clipboard. Sends a lot of
user data back to its servers.
Hola Unblocker (2015) DDoS Easy-access to region blocked content. Bandwidth from users being
sold to cover costs (powers botnets for attack).
Marauder’s Map (2015) Spying Plot your friends’ location data from Facebook on a map. A hacker
can know if you’re not home, shops you visit frequently, who you
spend most time with.
Viralands (2016) Phishing “Verify your age” to access restricted content. Access to Facebook
access token; login credentials stolen.
iCalc (2016) Webpage Manipulation Functional Calculator. Creates a proxy and intercept web requests,
taking commands and updates from a domain.
Dubbed Copyfish (2017) Mal-Ads Extract text from images, PDFs, videos. Equipped with ad injection
capabilities.
Web Developer (2017) Affiliate Fraud Adds a toolbar button to the browser with web developer tools.
Substitute ads on browser, hijacking traffic from legit ad networks.
Nano Adblocker/Nano Defender (2020) Spying Adblocker. Collected user data and sent it to remote servers.
The Great Suspender (2021) Malware Suspends unused tabs to save memory. Injected malicious code to steal
data.
SessionManager (2022) Data Theft Manage browser sessions. Stole session cookies and other data.
Sakula Rat (2023) Remote Access Trojan Used for APT campaigns. Allowed remote control and data exfiltration
from infected browsers.
Session Stealer (2023) Hijacking Manage browser sessions. Stole active session cookies to hijack ac-
counts.
Cyberhaven (2024) Supply Chain Compromised via phishing targeting developer accounts. Distributed
malicious versions, stealing Facebook access tokens and bypassing
2FA.
StealthSpy (2024) Spying Disguised as a productivity enhancer. Secretly records browsing his-
tory and keylogs sensitive data.
AdSkimmer Pro (2024) Ad Fraud Claimed to block ads. Injected its own ads and skimmed affiliate
commissions from legitimate sites.
QuickAccess Helper (2024) Phishing Promised faster access to commonly visited sites. Redirected users to
phishing pages that stole credentials.

Our research involved creating and testing multiple to achieve similar results. Firefox’s continued support for
extensions to evaluate their impact on privacy and security. the Web Request API increased its exposure to data in-
Minimal permissions—such as activeTab, scripting, and terception threats. Case studies from 2024 illustrate these
storage—were sufficient for executing harmful actions, risks. Cyberhaven revealed how a supply chain attack
making these tools easy to develop even for low-skilled compromised developer accounts to distribute extensions
attackers. For example, the Cookie Stealing and Keylogger that stole Facebook access tokens and bypassed two-factor
Extensions accessed login credentials and cookies, exfil- authentication. StealthSpy, initially marketed as a pro-
trating this data to remote servers. The Screenshot Capture ductivity tool, later functioned as a keylogger, capturing
and History Tracker Extensions covertly recorded user user keystrokes via Chrome’s scripting API. AdSkimmer
activity, offering attackers insights into browsing behavior. Pro, disguised as an ad-blocker, injected advertisements
Notably, Chrome’s Web Store exhibited stricter security and intercepted affiliate revenue, causing financial losses.
policies, flagging high-risk behaviors like unauthorized QuickAccess Helper, promoted as a browsing speed en-
cookie access, keystroke logging, and direct DOM ma- hancer, redirected users to phishing sites for credential
nipulation, while Firefox’s Add-ons Store showed greater theft.
susceptibility to obfuscation techniques. Extensions de-
signed to modify web content, inject ads, or track user
activity were more likely to pass Firefox’s review when
disguised as productivity tools.
Despite security enhancements, certain types of ex- These incidents highlight the need for stronger security
tensions, such as those that manipulate browsing his- measures across all browsers [5], [8], [9], [10]. While
tory or automate actions like liking content, continue to Chrome’s MV3 has reduced attack vectors, threat actors
evade detection. Recent attacks in 2024 further exposed continue adapting. Firefox’s lenient API policies present
browser vulnerabilities. Extensions like DataPhisher and trade-offs between security and flexibility, while Edge and
StealthSpy bypassed detection with advanced obfuscation, Safari face similar challenges. Continuous improvements
harvesting credentials and manipulating web traffic [26]. in anomaly detection, stricter vetting, and behavioral anal-
While MV3 restricted direct network access in Chrome, ysis are essential to mitigating the ongoing risks posed by
attackers leveraged injected scripts and permission abuse browser extensions.
4. Malicious Browser Extensions: Threat • Request Forgery Extensions : These extensions
Landscape in 2025 focus on state-changing actions without user con-
sent. They can manipulate web requests to exe-
Malicious Browser extensions represent a growing cute unauthorized actions such as changing user
threat to user data privacy and security. This section settings, submitting forms, or initiating financial
explores the various types of threats posed by these ex- transactions. These activities can lead to unautho-
tensions in the year 2025 and discusses their implications. rized access, data breaches, and exploitation of
The study in this section has been done by the authors in users’ online accounts.
their laboratory environment over a period of 6 months. • Miscellaneous Extensions : Malicious Browser
The researchers were motivated to build a set of extensions extensions are adept at bypassing security mech-
over MV3 for chrome and MV2 for firefox and using the anisms designed to protect users. They can avoid
existing APIs exposed by Chrome and Mozilla till Decem- detection by security tools, and exploit vulnerabil-
ber 2024 to cause a security or privacy issue to the user ities in browsers or other software [26]. Further-
that installs the extensions. The extensions developed were more, they may engage in network-based attacks
tested by another researcher and verified to be working to disrupt users’ Internet connections and prop-
fine over their browsers before including them into the set agate themselves via social engineering tactics.
of extensions discussed in this paper. Due to the reason Additionally, some extensions are specifically de-
that such extensions can be misused and to not provide signed to manipulate the appearance or functional-
an easy-to-build environment of such extensions to script ity of websites, such as altering background colors
kiddies, only a portion of the codes of the extension or injecting hidden elements into the page. While
is displayed here and no completed code reference has these may seem innocuous at first glance, they can
been hosted at any platform. The researchers have studied be used for malicious purposes such as redirecting
past work and extensions and tested through experiments users to fraudulent sites or tricking them into
whether the threats raised via researchers in the past are revealing sensitive information. Furthermore, ma-
still there or are patched and whether there are possibilities licious extensions can pose risks through deceptive
of new, more capable malicious extensions that can be actions, such as impersonating legitimate tools or
developed with the new set of APIs which are available to services.
third-party developers. We have discussed some important
malicious browser extensions that we experimented and 5. Experimenting Browser MBEs in 2025
tested during our study. We classified various extensions
that we studied based on the types of threat they pose into During our research one of our major contribution is
the below given 5 classes: that we have created a set of innovative malicious browser
extensions from the past based on the categorization of
• Data Stealing Extensions : Data theft is a pri- malicious actions described in the threat model and re-
mary concern associated with malicious Browser alized their execution on the latest and Chrome browser
extensions. These extensions can harvest sensitive Version 131.0.6778.20 and and Firefox browser Version
information such as names, addresses, phone num- 123.0. While we discuss the high-level functionality and
bers, and email addresses. Furthermore, they are provide key snapshots of these extensions, we have de-
capable of capturing login credentials and stealing liberately withheld the complete code to prevent misuse
financial information such as credit card numbers by malicious actors and script kiddies. To assess whether
and bank account details. the created malicious extensions could bypass Chrome
• Monitoring and Surveillance Extensions : Ma- Web Store’s and Mozilla Add-On’s vetting process, we at-
licious extensions often include monitoring and tempted to submit sample extensions. The extensions that
surveillance capabilities. They can track users’ requested excessive permissions or contained obfuscated
browsing history, record keystrokes through key- code were flagged during automated scans. However,
logging techniques, and even take screenshots of those mimicking legitimate functionality with delayed ma-
users’ screens without their knowledge or consent. licious behavior remained undetected, highlighting gaps
This surveillance can compromise users’ privacy in security review system. This research provides insights
and expose sensitive information. Privacy invasion into the evolving threat landscape and highlights how such
is another significant threat posed by malicious extensions can compromise privacy and security.
Browser extensions. These extensions may access
a user’s camera and microphone without autho- 5.1. Cookie Stealing Extension
rization, potentially recording audio and video.
Additionally, they can track a user’s physical lo- The cookie-stealing extension represents a critical se-
cation using geolocation APIs, exploiting this in- curity threat by demonstrating how malicious browser
formation for malicious purposes. extensions can access and log important access tokens
• Content Manipulation Extensions : Manipula- such as cookies without user consent. Attackers can use
tion of web content by malicious extensions is this method to hijack user sessions, steal authentication
a tactic used to deceive users and achieve nefar- tokens, and exfiltrate sensitive information.
ious goals. Extensions can inject advertisements The extension operates by listening for specific
into web pages, modify content to mislead users, messages from the browser, particularly those request-
and employ social engineering techniques to trick ing cookie information. Upon receiving such a re-
users into divulging sensitive information. quest, it extracts the domain from the active tab’s URL
and utilizes the chrome.cookies.getAll (for Chrome) or to extract information from restricted web applications and
browser.cookies.getAll (for Firefox) [17] API to retrieve all compromise user security.
cookies associated with that domain. The extension then The extension’s background script initializes upon
logs these cookies, including their names and values, and installation using chrome.runtime.onInstalled.addListener
exfiltrates them to a remote server using a JavaScript Fetch (Chrome) or browser.runtime.onInstalled.addListener
API request. This method allows attackers to gain access (Firefox) [21]. The extension monitors tab activity
to users’ authentication tokens, leading to session hijack- using chrome.tabs.onUpdated.addListener (Chrome)
ing and unauthorized account access. The permissions or browser.tabs.onUpdated.addListener (Firefox) [18],
required for this operation include cookies, activeTab, and ensuring it captures screenshots as soon as a user
storage as shown in Figure 1. navigates to a new webpage. The captured screenshot is
then forwarded to an attacker-controlled server via an
HTTP request.
The captureAndDownloadScreenshot function
utilizes chrome.tabs.captureVisibleTab (Chrome) or
browser.tabs.captureVisibleTab (Firefox) [18] to take
Figure 1. Cookie stealing operation in Chrome and Firefox extensions.
a PNG-format screenshot. The required permissions
include tabs, activeTab, scripting, and storage as shown
in Figure 3.
5.2. Keylogger Extension
Keyloggers remain one of the most severe security
threats in the digital landscape, as they covertly cap-
ture sensitive user inputs, including passwords, personal
messages, and financial details. The implementation of a
keylogger through a browser extension allows for discreet
data collection without the user’s awareness.
In this study, we implemented a keylogger using both
Chrome and Firefox extensions to analyze its feasibility
Figure 3. Screenshot capture process in Chrome and Firefox extensions.
and impact. The extension works by injecting an event
listener into web pages to monitor keypress events. The
collected keystrokes are then sent to a background script
that processes and logs them. The background script lis- 5.4. History Tracker by Browser Extension
tens for messages from the content script and retrieves
recorded keystrokes, which are processed and sent to an
This extension falls under the category of privacy inva-
external server for storage.
sion and data exfiltration attacks. By leveraging browser
When a message of type getKeys is received, the
APIs, it collects users’ browsing history, which can be
background script queries the currently active tab us-
used for profiling, targeted phishing, and user behavior
ing chrome.tabs.query (Chrome) or browser.tabs.query
analysis.
(Firefox) [18]. The recorded keystrokes are then for-
warded using chrome.tabs.sendMessage (Chrome) or The extension accesses historical browsing data using
browser.tabs.sendMessage (Firefox) [18], as shown in Fig- chrome.history.search, chrome.history.getVisits (Chrome)
ure 2. The extension requires activeTab, scripting, and or browser.history.search, browser.history.getVisits (Fire-
storage permissions. fox) [22]. It logs the extracted URLs along with times-
tamps and user interactions, creating a comprehensive
record of the user’s online activity. The data is then
transmitted to an external server controlled by the attacker.
The permissions required include history, tabs, script-
ing, and storage. Figure 4 demonstrates this extension’s
activity.

Figure 2. Keylogger operation in Chrome and Firefox extensions.

5.3. Screenshot Capture by Browser Extension

Malicious browser extensions can covertly capture
screenshots of the active tab, potentially exposing sen- Figure 4. Demonstration of a history-tracking extension in Chrome and
sitive data such as credentials, financial transactions, and Firefox.
private communications. This capability enables attackers
5.5. Auto-Like YouTube Videos 5.7. Camera Auto On by Browser Extension

The Auto-Like YouTube Videos extension demon- Unauthorized camera access remains a significant
strates how browser extensions can manipulate engage- privacy threat posed by malicious browser extensions.
ment metrics on social media platforms. This manipula- This extension demonstrates how an attacker can exploit
tion affects content ranking algorithms and distorts user navigator.mediaDevices.getUserMedia to activate a user’s
engagement patterns. camera without explicit consent.
The extension monitors YouTube pages for video el- Upon installation, the extension injects JavaScript
ements and automatically triggers a “Like” action when into webpages using chrome.scripting.executeScript
a user hovers over a video thumbnail. It does this using (Chrome) or browser.scripting.executeScript
document.querySelector to detect the YouTube like but- (Firefox) [18], ensuring it runs persistently in the
ton and executes a simulated click event. The extension background. The extension listens for browser
employs MutationObserver [24] to ensure the auto-like events using chrome.tabs.onUpdated.addListener or
functionality persists across dynamic page changes. This browser.tabs.onUpdated.addListener, allowing it to
method can be leveraged by malicious actors to artificially activate the camera each time the user loads a webpage.
inflate video rankings and influence recommendations. Once triggered, it automatically enables video recording
The required permissions include tabs, activeTab, and streams the feed to an external server.
scripting, and storage. Figure 5 illustrates this behavior. While Chrome and Firefox enforce user permission
requests for media access, extensions with broad per-
missions can manipulate these settings post-installation,
creating a persistent security risk. Figure 7 illustrates this
exploit.

Figure 5. YouTube Auto-Like Extension in Chrome and Firefox.

5.6. Manipulation of Web Content by Browser

Extensions

This extension dynamically modifies web content, pos-

ing significant security risks such as phishing, deceptive
redirects, and unauthorized content injection. Attackers
Figure 7. Camera Auto On Extension Script Injection in Chrome and
can use such extensions to alter webpage elements, ma- Firefox.
nipulate hyperlinks, or inject malicious advertisements,
leading to data theft or fraud.
The extension operates by leveraging the MutationOb- 5.8. Injecting Advertisement through Browser
server API [24] to monitor DOM changes. It continuously Extensions
scans for specific elements, such as anchor tags, and
replaces their href attributes to redirect users to attacker- One of the browser extensions we analyzed is the
controlled domains. This technique allows attackers to “Inject Advertisement” extension, which falls under Un-
conduct phishing attacks by redirecting users to fraud- wanted Ad Injection attacks. This type of extension dis-
ulent login pages or injecting rogue advertisements onto rupts user experience by injecting unauthorized adver-
legitimate websites as shown in Figure 6. . tisements onto web pages without consent. These ads
Chrome and Firefox both allow extensions to modify typically appear as floating banners, pop-ups, or over-
web content, but their implementation of security restric- lays positioned over legitimate content, often redirecting
tions varies. Chrome’s MV3 model imposes stricter limita- users to external sites, some of which may be fraudu-
tions on dynamic script execution, whereas Firefox retains lent or malicious. The extension dynamically creates an
more flexibility, allowing direct script manipulation in advertisement container, a div element, positioned in the
certain contexts. This distinction impacts the effectiveness bottom-right corner of the screen. This container contains
of security policies designed to mitigate such threats. a header, descriptive text, and a close button, although
some malicious versions prevent users from dismissing
the ad. The core functionality is implemented via the
injectAd() function, as shown in Figure 8, which uses
JavaScript to create and style the advertisement before
appending it to the webpage’s DOM. The extension listens
for page load events using window.onload and employs the
MutationObserver API to detect dynamic content changes,
ensuring the ad persists even when users navigate between
Figure 6. JavaScript code snippet for dynamic link modification in pages.
Chrome and Firefox extensions. Although the extension only requires the activeTab
permission, more advanced versions may request storage
for tracking user interactions, cookies for targeted ad injec- sufficient for executing harmful actions, making these
tion, and webRequest to manipulate network traffic. Such tools easy to develop even for low-skilled attackers. For
extensions can pose serious security risks, including click example, the Cookie Stealing and Keylogger Extensions
fraud, traffic hijacking, and phishing attacks by disguising accessed sensitive data like login credentials and cook-
ads as legitimate notifications or login prompts. Addition- ies, then exfiltrated this information to remote servers.
ally, attackers can replace genuine ads with their own, Similarly, the Screenshot Capture and History Tracker
diverting revenue from website owners. Some variants use Extensions covertly recorded user activity and captured
drive-by downloads to deliver malware upon interaction screenshots, providing attackers with detailed insights into
with the ad. browsing behavior. When evaluating the security mea-
sures of Chrome and Firefox extension stores, we ob-
served notable differences in their ability to detect and
block malicious extensions. Chrome’s Web Store exhib-
ited stricter security policies, flagging high-risk behaviors
such as unauthorized cookie access, keystroke logging,
and direct DOM manipulation. Extensions attempting to
modify browsing history or inject advertisements were
often detected and removed during the review process.
On the other hand, Firefox’s Add-ons Store demonstrated
Figure 8. JavaScript code snippet for dynamic advertisement injection. greater susceptibility to bypass techniques, particularly
when malicious behavior was obfuscated within exten-
sions that appeared to provide legitimate functionality.
5.9. Email Inbox Spying by Browser Extensions For instance, extensions that manipulated web content,
injected ads, or tracked user activity were more likely to
This extension highlights the privacy risks posed by pass Firefox’s review when disguised as productivity tools
unauthorized email monitoring. By exploiting browser or interface enhancements. Additionally, we successfully
APIs, it enables attackers to track unread emails, extract created a To-Do List Extension on Mozilla that con-
metadata, and manipulate webmail interfaces without the tained obfuscated malicious code to inject advertisements,
user’s knowledge. The extension operates by monitoring which successfully bypassed Mozilla’s review process
the DOM for elements representing unread emails. It and remains active on the Add-ons Store [37]. Similarly,
identifies and highlights specific email classes, such as .zE we developed a 25-Minute Timer Extension on Mozilla
in Gmail, using JavaScript. Once identified, it modifies the that included hidden functionality for automatically liking
CSS properties of these elements, making them visibly YouTube videos, demonstrating that extensions with be-
distinct (e.g., changing the background color to yellow, nign primary functions can effectively disguise malicious
#ffeb3b). Additionally, the extension logs email metadata intent and evade detection [36]. On Chrome, we created
and transmits it to an external server, facilitating targeted an extension that displayed a pop-up showing YouTube
phishing attacks. access time while secretly implementing an auto-liking
Chrome and Firefox impose different restrictions on mechanism for YouTube videos. This extension was suc-
DOM manipulation by extensions. While Chrome’s MV3 cessfully published on the Chrome Web Store and remains
enforces stricter execution policies, Firefox’s WebExten- active, highlighting weaknesses in Chrome’s automated
sions API allows broader modifications, increasing poten- review process for behavioral detection [35].
tial security risks. Despite Chrome’s stronger enforcement mechanisms,
The extension requires minimal permis- certain types of extensions, such as those designed for
sions—scripting, storage, and activeTab—to perform auto-liking content and modifying browsing history, could
these operations effectively. Figure 9 illustrates a still evade detection by embedding their malicious logic
JavaScript snippet demonstrating this attack. within seemingly harmless scripts. Similarly, Firefox’s
review process was found to be more lenient toward
extensions with broad permissions, allowing them to per-
form unauthorized data collection and behavioral tracking
under the guise of enhancing user experience. The Camera
Auto-On Extension further demonstrated the risks posed
by persistent permissions, as it was capable of secretly
activating a user’s camera on both browsers, albeit with a
higher likelihood of detection in Chrome due to its stricter
Figure 9. JavaScript code snippet for highlighting unread emails in
permission review system.
Chrome and Firefox. Table 2 provides a comparative analysis of these exten-
sions, detailing their capabilities, exploited APIs, required
permissions, and the likelihood of bypassing security mea-
5.10. Analysis and Observations sures in Chrome and Firefox. Although both browsers
employ security mechanisms, the deceptive tactics used
Our research involved creating and testing multiple by these extensions highlight significant gaps in the re-
malicious browser extensions to evaluate their impact on view process, particularly in Firefox’s ability to detect
privacy and security. A key finding is that minimal per- obfuscated threats. These findings emphasize the need
missions—such as activeTab, scripting, and storage—are for more rigorous permission validation, improved static
 TABLE 2. D ETAILED D ISCUSSION OF M ALICIOUS B ROWSER E XTENSIONS C REATED AND T HEIR B YPASSING P OTENTIAL
Name Description API Exploited Required Scripts Permissions Lines of Code Chrome Web Store Mozilla Add-on Store
Cookie Stealing Exten- Steals cookies, enabling ses- chrome.cookies.getAll, Background Script cookies, activeTab, 20-30 Not Possible – Requires Successfully Published on
sion sion hijacking and unautho- Fetch API storage cookies permission, de- Add-on Store for Mozilla
rized access to user accounts. tected easily – Can be obfuscated in a
sync manager
Keylogger Extension Captures keystrokes to steal chrome.tabs.query, Content & Back- activeTab, scripting, 70-90 Not Possible – Keyboard Successfully Published on
sensitive information such as chrome.tabs.sendMessage ground Script storage event tracking flagged Add-on Store for Mozilla
passwords, credit card num- – If embedded in a typing
bers, and personal messages. tool
Screenshot Capture Secretly captures screenshots chrome.tabs.captureVisible Background Script tabs, activeTab, script- 30-40 Not Possible – Screenshots Successfully Published on
Extension of the user’s activity and ex- Tab, Fetch API ing, storage trigger manual review Add-on Store for Mozilla –
filtrates the data to a remote Can justify as a productiv-
server for malicious purposes. ity tool
History Tracker Exten- Surreptitiously monitors and chrome.history.search, Background Script history, tabs, scripting, 40-50 Not Possible – Brows- Successfully Published on
sion logs browsing history, enabling chrome.history.getVisits storage ing history requires permis- Add-on Store for Mozilla –
user profiling and data exfiltra- sions If marketed as ”Browsing
tion to external servers. Insights”
Auto-Like YouTube Manipulates user engagement MutationObserver, Background Script tabs, activeTab, script- 40-50 Successfully Published on Successfully Published on
Videos Extension on YouTube by automatically document.querySelector ing, storage Chrome Web Store – If em- Add-on Store for Mozilla –
liking videos, skewing algo- bedded in focus tools [35] Easily hidden in productiv-
rithms, and distorting user ac- ity tools [36]
tivity.
Manipulation of Web Alters webpage content to trick MutationObserver, Content & Back- scripting, tabs, storage 50-60 Not Possible – DOM mod- Successfully Published on
Content Extension users into phishing schemes, chrome.scripting.execute ground Script ification triggers review Add-on Store for Mozilla
redirecting them to malicious Script – If disguised as a UI en-
websites, or stealing sensitive hancement
information.
Camera Auto On Ex- Activates the user’s camera navigator.mediaDevices. Background Script camera, tabs, scripting 35-45 Not Possible – Direct cam- Successfully Published on
tension without consent, enabling re- getUserMedia, era activation blocked Add-on Store for Mozilla –
mote surveillance and pri- chrome.scripting.execute Possible with delayed trig-
vacy violations, and sending Script gers
recorded video to a backend
server.
Injecting Adver- Injects unwanted ads that could document.createElement, Content & Back- activeTab 30-40 Possible – Can be hidden Successfully Published on
tisement Malicious lead to phishing attacks, mal- docu- ground Script in UI tweaks Add-on Store for Mozilla
Extension ware downloads, or disturb ment.body.appendChild – If positioned as a cus-
user experience. tomization tool [37]
Email Inbox Spying Monitors and manipulates un- document.querySelector, Content & Back- scripting, storage, ac- 20-30 Not Possible – Gmail Successfully Published on
Extension read email indicators in web- chrome.scripting.execute ground Script tiveTab tracking gets flagged Add-on Store for Mozilla
mail, enabling surveillance of Script – Can blend into ”Email
private communication and ex- Organizer”
filtrates email data.

and dynamic analysis tools, and enhanced monitoring particularly in Firefox’s review process, by integrating en-
mechanisms to prevent unauthorized access to user data hanced static and dynamic analysis techniques capable of
and mitigate the risks posed by malicious extensions. detecting obfuscation and hidden payloads. Additionally,
real-time monitoring mechanisms should be implemented
6. Conclusions to detect behavioral anomalies even after an extension has
been approved. Ensuring that updates to extensions un-
Browser extensions, while offering enhanced function- dergo rigorous security checks, rather than relying solely
ality, pose a significant threat to user privacy and security on pre-approval evaluations, is crucial for mitigating post-
due to their vulnerabilities. This study has demonstrated publication risks. Simultaneously, users must be educated
how malicious browser extensions can exploit minimal on the dangers posed by browser extensions and encour-
permissions to execute attacks such as data theft, surveil- aged to grant permissions judiciously.
lance, and unauthorized content manipulation. A key find- Future research should focus on improving real-time
ing is the disparity between Chrome and Firefox in de- behavioral analysis of browser extensions, refining per-
tecting and mitigating these threats. While Chrome’s Web mission models, and establishing industry-wide vetting
Store enforces stricter security measures, blocking many standards to mitigate these persistent threats. In particu-
high-risk behaviors such as unauthorized cookie access lar, developing sophisticated anomaly detection techniques
and keystroke logging, Firefox’s Add-ons Store remains and fostering collaboration between browser vendors, se-
more susceptible to bypassing techniques, particularly curity researchers, and policymakers can enhance the ef-
when malicious behavior is obfuscated within seemingly fectiveness of existing defenses. Standardizing permission
benign extensions. transparency and incorporating automated rollback mech-
Alarmingly, despite extensive research, the solutions anisms for post-publication updates will be critical steps
proposed by the academic and cybersecurity community in strengthening browser extension security. Ultimately,
are rarely implemented in real-world scenarios. The ability bridging the gap between theoretical security measures
of attackers to disguise malicious intent within productiv- and their real-world implementation is essential. Without
ity or customization tools highlights critical weaknesses in proactive efforts from the industry and researchers, ma-
the current extension vetting process. Moreover, creating licious extensions will continue to exploit vulnerabilities,
and distributing malicious extensions remains alarmingly posing a persistent threat to the digital ecosystem.
simple, and current security measures fail to address the
risks posed by post-publication modifications. Once an
extension is approved and published, there is little over- References
sight ensuring that subsequent updates do not introduce
malicious functionalities. This gap in continuous security
[1] BrowserStack, ”Understanding browser market share,” 2024.
monitoring exposes users to persistent cyber threats. [Online]. Available: https://www.browserstack.com/guide/
Addressing these challenges requires a multi-faceted understanding-browser-market-share#:∼:text=in%20their%
approach. Browser vendors must enforce stricter policies, 20positions.. [Accessed: Jan. 8, 2025].
[2] A. Bridgwater, ”How browser extensions work,” *Forbes*, [17] Google Developers, ”Chrome Extension Cookies API,” 2024.
Apr. 16, 2019. [Online]. Available: https://www.forbes.com/sites/ [Online]. Available: https://developer.chrome.com/docs/extensions/
adrianbridgwater/2019/04/16/how-browser-extensions-work/. [Ac- reference/api/cookies. [Accessed: Jan. 8, 2025].
cessed: Jan. 8, 2025]. [18] Google Developers, ”Chrome Extension Tabs API,” 2024. [Online].
[3] J. Corpuz, ”41 best Google Chrome extensions,” *Tom’s Available: https://developer.chrome.com/docs/extensions/reference/
Guide*, 2017. [Online]. Available: https://www.tomsguide. api/tabs. [Accessed: Jan. 8, 2025].
com/us/pictures-story/283-best-google-chrome-extensions.html. [19] P. Tuli and P. Sahu, ”System monitoring and security using key-
[Accessed: Jan. 8, 2025]. logger,” Int. J. Comput. Sci. Mobile Comput., vol. 2, pp. 106–111,
[4] Trend Micro, “ParaSiteSnatcher: How Malicious Chrome 2013.
Extensions Target Brazil,” Dec. 2023. [Online]. Avail- [20] I. Kantor, ”Keyboard: keydown and keyup,” 2017. [Online].
able: https://www.trendmicro.com/en in/research/23/k/ Available: https://javascript.info/keyboard-events. [Accessed: Jan.
parasitesnatcher-how-malicious-chrome-extensions-target-brazil-. 8, 2025].
html [21] Google Developers, ”Chrome Extension Runtime API,” 2024.
[5] Cyberhaven Engineering Team, ”Cyberhaven’s Preliminary [Online]. Available: https://developer.chrome.com/docs/extensions/
Analysis of the Recent Malicious Chrome Extension,” reference/api/runtime. [Accessed: Jan. 8, 2025].
Cyberhaven Engineering Blog. [Online]. Available: [22] Google Developers, ”Chrome Extension History API,” 2024.
https://www.cyberhaven.com/engineering-blog/cyberhavens- [Online]. Available: https://developer.chrome.com/docs/extensions/
preliminary-analysis-of-the-recent-malicious-chrome-extension. reference/api/history. [Accessed: Jan. 8, 2025].
[Accessed: Jan. 9, 2025].
[23] Google Developers, ”Chrome Extension Scripting API,” 2024.
[6] SoyaCincau, ”Chrome Extension AdBlocker Infected [Online]. Available: https://developer.chrome.com/docs/extensions/
with Malware – Nano Adblocker and Nano Defender,” reference/api/scripting. [Accessed: Jan. 8, 2025].
SoyaCincau, Oct. 21, 2020. [Online]. Available:
https://soyacincau.com/2020/10/21/chrome-extension-adblocker- [24] MDN Web Docs, ”MutationObserver,” 2024. [Online].
infected-malware-nano-adblocker-nano-defender/. [Accessed: Jan. Available: https://developer.mozilla.org/en-US/docs/Web/API/
9, 2025]. MutationObserver. [Accessed: Jan. 8, 2025].
[25] SquareX, ”Millions of enterprises at risk: SquareX
[7] The Hacker News, ”Warning: Hugely Popular ’Great Suspender’
shows how malicious extensions bypass Google’s MV3
Chrome Extension Found Spreading Malware,” The Hacker News,
restrictions,” presented at DEF CON 32, Oct. 2024.
Feb. 2021. [Online]. Available: https://thehackernews.com/2021/
[Online]. Available:https://www.globenewswire.com/news-
02/warning-hugely-popular-great-suspender.html. [Accessed: Jan.
release/2024/10/03/2957857/0/en/Millions-of-Enterprises-at-
9, 2025].
Risk-SquareX-Shows-How-Malicious-Extensions-Bypass-Google-
[8] The Hacker News, ”16 Chrome Extensions Hacked, Exposing s-MV3-Restrictions.htmll
Millions of Users to Malicious Attacks,” The Hacker News, Dec.
[26] BleepingComputer, ”New details reveal how hackers hijacked
16, 2024. [Online]. Available: https://thehackernews.com/2024/12/
35 Google Chrome extensions,” 2024. [Online]. Available:
16-chrome-extensions-hacked-exposing.html. [Accessed: Jan. 9,
https://www.bleepingcomputer.com/news/security/new-details-
2025].
reveal-how-hackers-hijacked-35-google-chrome-extensions/.
[9] Ars Technica, ”Popular Chromium Ad Blockers Caught Stealing [Accessed: Jan. 8, 2025].
User Data and Accessing Accounts,” Ars Technica, Oct. [27] Y. Wang, W. Cai, P. Lyu, and W. Shao, Detecting malicious browser
2020. [Online]. Available: https://arstechnica.com/information- extensions, Northwestern Polytechnical University, Xi’an, 2018.
technology/2020/10/popular-chromium-ad-blockers-caught-
stealing-user-data-and-accessing-accounts. [Accessed: Jan. 9, [28] K. Kaushik, S. Aggarwal, S. Pandey, S. Mudgal, and S. Garg,
2025]. Investigating and safeguarding the web browsers from malicious
web extensions, Univ. Petroleum Energy Studies, Dehradun, India,
[10] Field Effect, ”33 Chrome Extensions Found to Be Malicious,” 2021.
Field Effect Blog. [Online]. Available: https://fieldeffect.com/blog/
33-chrome-extensions-found-to-be-malicious. [Accessed: Jan. 9, [29] G. Varshney and M. Misra, Browshing: A new way of phishing us-
2025]. ing a malicious browser extension, Indian Inst. Technol., Roorkee,
India, 2016.
[11] M. Maunder, ”PSA: 4.8 million affected by Chrome exten-
sion attacks targeting site owners,” *Wordfence Blog*, Aug. 17, [30] A. Kapravelos, C. Grier, N. Chachra, C. Kruegel, G. Vigna, and V.
2017. [Online]. Available: https://www.wordfence.com/blog/2017/ Paxson, Hulk: Eliciting malicious behavior in browser extensions,
08/chrome-browser-extension-attacks/. [Accessed: Jan. 8, 2025]. Univ. California Santa Barbara, Berkeley, San Diego, 2018.
[12] D. Price, ”4 malicious browser extensions that help [31] H. Shahriar, K. Weldemariam, M. Zulkernine, and T. Lutellier,
hackers target their victims,” *MakeUseOf*, Jul. 13, Effective detection of vulnerable and malicious browser extensions,
2015. [Online]. Available: http://www.makeuseof.com/tag/ 2018.
x-malicious-browser-extensions-help-hackers-target-victims/. [32] N. Pantelaios, N. Nikiforakis, and A. Kapravelos, You’veChanged:
[Accessed: Jan. 8, 2025]. Detecting malicious browser extensions through their update
deltas, North Carolina State Univ., Stony Brook Univ., 2017.
[13] G. Varshney, S. Bagade, and S. Sinha, ”Malicious browser ex-
tensions: A growing threat: A case study on Google Chrome: [33] M. Maunder, “PSA: 4.8 Million Affected by Chrome Ex-
Ongoing work in progress,” in Proc. Int. Conf. Information Net- tension Attacks Targeting Site Owners,” Wordfence Blog,
working (ICOIN), Chiang Mai, Thailand, 2018, pp. 188–193. Aug. 2017. Available: https://www.wordfence.com/blog/2017/08/
doi: 10.1109/ICOIN.2018.8343108. [Online]. Available: https:// chrome-browser-extension-attacks/
ieeexplore.ieee.org/document/8343108. [34] J. M. Moreno, N. Vallina-Rodriguez, and J. Tapiador, “Did
[14] Google, ”Staying safe with Chrome extensions,” Google Security I Vet You Before? Assessing the Chrome Web Store Vet-
Blog, Jun. 20, 2024. [Online]. Available: https://security. ting Process through Browser Extension Similarity,” arXiv
googleblog.com/2024/06/staying-safe-with-chrome-extensions. preprint arXiv:2406.00374, 2024. Available: https://arxiv.org/abs/
html. [Accessed: Jan. 8, 2025]. 2406.00374
[15] G. Varshney, M. Misra, and P. K. Atrey, ”Cyberattacks via Google [35] Google Chrome Web Store, ”YouTube Fo-
Chrome browser extensions,” in World Scientific Reference on cus Timer & Stats,” 2025. [Online]. Available:
Innovation, Chapter 9, pp. 193–210, 2024. [Online]. Available: https://chromewebstore.google.com/detail/ejmfemchnobpkbmnidhb
https://doi.org/10.1142/9789813149106 0009. [Accessed: Jan. 8, bledmajpehnp. [Accessed: Mar. 6, 2025].
2025]. [36] Mozilla Add-ons, ”Focus Timer - Stay Productive,” 2025. [Online].
[16] W. Chang and S. Chen, ”Extension Board: Towards runtime Available: https://addons.mozilla.org/en-US/firefox/addon/focus-
browser extension information leakage detection,” in Proc. IEEE timer-stay-productive/. [Accessed: Mar. 6, 2025].
Conf. Commun. Netw. Security (CNS), 2016. [Online]. Available: [37] Mozilla Add-ons, ”Easy To-Do List,” 2025. [Online]. Available:
https://ieeexplore.ieee.org/document/7860481. [Accessed: Jan. 8, https://addons.mozilla.org/en-US/firefox/addon/easy-to-do-list/.
2025]. [Accessed: Mar. 6, 2025].