Protect Yourself from Browser Extension Malware Installed

Browser extensions enhance productivity, but they also represent a significant attack surface. Malicious extensions can steal credentials, inject ads, manipulate pages, and exfiltrate sensitive data—all while appearing legitimate. This guide provides concrete techniques for identifying and protecting against browser extension malware that installs secretly.

Understanding the Threat Landscape

Browser extensions operate with broad permissions. Once installed, they can access the DOM of every page you visit, read cookies, intercept network requests, and store data locally. This privileged position makes them attractive to attackers.

Extensions can end up on your system through several vectors:

Trojanized extensions: Legitimate-looking extensions with hidden malicious functionality
Compromised developer accounts: Attackers inject code into popular extensions
Social engineering: Trickery into installing malicious extensions
Pre-installed bloatware: Some browsers ship with potentially unwanted extensions

The “secretly installed” aspect often involves extensions that bundle with other software, survive browser reinstalls, or persist through browser updates.

Auditing Your Installed Extensions

Regular auditing is essential. Here’s how to systematically review your extensions.

Chrome and Chromium-Based Browsers

Access your extensions at chrome://extensions. Enable “Developer mode” to see additional details. Each extension displays its version, permissions, and a unique ID—a 32-character string that remains constant across updates.

To programmatically list installed extensions, you can examine the profile directory:

# Chrome extensions directory (macOS)
ls ~/Library/Application\ Support/Google/Chrome/Default/Extensions/

# Firefox extensions directory
ls ~/.mozilla/firefox/*.default/extensions/

Each subdirectory corresponds to an extension ID. Cross-reference IDs against known-malicious lists available from security researchers.

Firefox

Firefox stores extensions in your profile directory with .xpi files (ZIP archives). To inspect an extension’s contents:

# List installed extensions
ls ~/.mozilla/firefox/*.default/extensions/

# Extract and examine manifest
unzip -q extension.xpi -d /tmp/extension-inspect/
cat /tmp/extension-inspect/manifest.json

The manifest.json file reveals requested permissions. Be suspicious of extensions requesting excessive access—a simple calculator extension has no business requesting access to all websites.

Detecting Malicious Behavior

Beyond static analysis, monitor extension behavior at runtime.

Network Traffic Monitoring

Malicious extensions often communicate with command-and-control servers. Use browser developer tools or a local proxy to monitor outbound connections:

// Console script to monitor fetch/XHR requests
const originalFetch = window.fetch;
const originalXHR = window.XMLHttpRequest;

window.fetch = function(...args) {
  console.log('[Network] fetch:', args[0]);
  return originalFetch.apply(this, args);
};

// Similar wrapper for XMLHttpRequest

Run this in your browser console to observe where your extensions are sending data.

Content Script Injection Detection

Malicious extensions often inject content scripts to manipulate pages. Create a detection script:

// Check for unexpected injected scripts
function detectInjectedScripts() {
  const scripts = document.querySelectorAll('script');
  const injected = Array.from(scripts).filter(script => {
    // Scripts without src are inline—potential injection
    return !script.src && !script.textContent.includes('//#sourceMappingURL');
  });

  console.log('Inline scripts found:', injected.length);
  injected.forEach((script, i) => {
    console.log(`Script ${i}:`, script.textContent.substring(0, 200));
  });
}

detectInjectedScripts();

Run this on pages where you enter sensitive information. Unexpected inline scripts warrant investigation.

Practical Protection Strategies

Principle of Least Privilege

Install only extensions you actively use. Review permissions before installing any extension. Ask yourself: does this extension need access to “All websites” to function? Many extensions request overly broad permissions.

Extension Sandboxing

Firefox provides enhanced tracking protection and container extensions for isolation. Chrome’s Manifest V3 limits background scripts, but significant attack surface remains.

Consider using separate browser profiles for different trust levels:

# Launch Chrome with a specific profile
google-chrome --profile-directory="Profile 2"

Keep your banking and sensitive activities in a minimal-profile browser with few extensions.

Automated Extension Auditing

For power users managing multiple machines, automate extension auditing:

#!/bin/bash
# audit-extensions.sh - List Chrome extensions with permissions

EXTENSION_DIR="$HOME/Library/Application Support/Google/Chrome/Default/Extensions"

for dir in "$EXTENSION_DIR"/*; do
  if [ -d "$dir" ]; then
    ext_id=$(basename "$dir")
    # Find the version directory
    version_dir=$(ls -1 "$dir" | head -1)
    if [ -n "$version_dir" ]; then
      manifest="$dir/$version_dir/manifest.json"
      if [ -f "$manifest" ]; then
        name=$(jq -r '.name // "Unknown"' "$manifest" 2>/dev/null)
        perms=$(jq -r '.permissions // [] | join(", ")' "$manifest" 2>/dev/null)
        echo "Extension: $name"
        echo "  ID: $ext_id"
        echo "  Permissions: $perms"
        echo ""
      fi
    fi
  fi
done

This script extracts all installed extensions and their permissions for review.

Staying Informed

Follow security researchers who track browser extension threats. The Chrome Web Store and Firefox Add-ons platforms occasionally remove malicious extensions, but detection isn’t instantaneous. Subscribe to vulnerability feeds and check extension reviews before installing.

Response: What If You Detect Malware

If you discover a malicious extension:

Disable immediately through browser settings
Delete the extension
Change passwords for sensitive accounts, especially if the extension had broad permissions
Review browser settings for unexpected changes—homepage, search engine, new bookmarks
Check other browsers on your system—the same extension may be installed elsewhere
Scan for additional malware—attackers often deploy multiple payloads

Hardening Your Browser

Beyond extension management, configure browser security settings:

Enable “Protect you and your device from dangerous sites” in Chrome
Use Firefox’s Strict tracking protection
Disable extension auto-update if you want manual control
Regularly clear browsing data, especially cookies and cache

For developers, consider using browser flags to restrict extension capabilities or launching with security-focused flags:

# Chrome with additional security restrictions
google-chrome --disable-extensions --disable-plugins --disable-javascript

This approach is impractical for daily browsing but useful for testing or sensitive operations.

Built by theluckystrike — More at zovo.one