Malicious browser extension
In plain terms
A useful extension you installed voluntarily, which reads every page you open — including your bank. It asked for that permission at install time, and you granted it.
Definition
A malicious browser extension is a module voluntarily installed by the user, whose permissions let it read or modify the content of the pages visited.
How it works
An extension runs inside the browser, which places it after encryption: it sees pages the way you see them, once decrypted. The "read and change your data on all sites" permission is requested by plenty of perfectly honest extensions — an ad blocker needs it — which makes it unremarkable at install time. Two paths lead to a problem. The first is an extension designed for this from the start, published with a real, useful function. The second is harder to see: an honest extension, with thousands of users, gets bought out or its developer account compromised, and an automatic update changes its behavior overnight. Nothing gets reinstalled, nothing is asked again, and the positive review you'd read was about the previous version.
Warning signs
- Extension requesting access to all sites for a function that doesn't justify it
- Ads or links appearing on sites that didn't show any before
- Search engine or home page changed without your action
- Extension installed by a program rather than by you
- Change in an old extension's behavior after an update
- Extension removed from the official store but still active in your browser
How to verify
Open the list of extensions and treat it like a guest list: each one should have a reason to be there. Read the permissions and compare them to the stated function — a unit converter doesn't need to read your bank. Remove anything you no longer use: a forgotten extension keeps running and updating.
What to do
Install sparingly, from official stores, and refuse an extension whose permissions exceed its function. Do a periodic clean-up: the main risk isn't what you install today, but what's still installed two years from now.
If it already happened
Remove the extension, then treat everything you visited while it was active as exposed: change the passwords of sensitive accounts from another device and revoke sessions, since an extension can read session tokens just as well as passwords. Then check the search engine and home page.
Frequently asked questions
- It comes from the official store — isn't it vetted?
- Stores run checks, but an extension is updated automatically after publication. An honest extension can be bought out or have its account compromised, and change behavior without anything being asked of you again.
- Why can an extension see my pages despite HTTPS?
- Because it runs inside the browser, after decryption. Encryption protects the page while it's in transit; the extension reads it once it has arrived, at the same place your eyes do.
Related attacks
Official sources
This article is part of the Website and browser attacks family. Last updated: 2026-09-02.