Hundreds of millions of Chrome browser users infected with malware through extensions

Up to 280 million Google Chrome browser users are facing security risks due to installing extensions.

Over the past three years, more than 280 million Chrome users have downloaded malicious extensions.

Stanford University and the CISPA Helmholtz Center for Information Security have just published research showing that from July 2020 to February 2023, 346 million users have installed extensions containing malicious code. Of these, 280 million Google Chrome extensions contained malware, 63 million extensions violated policies and 3 million extensions were vulnerable to attacks. At that time, there were nearly 125,000 extensions available in the Chrome Store.

The researchers collected the data by parsing each extension's *.json declaration file. These files were then broken down into Application Programming Interface (API) permissions such as storage, cookies, and hosts such as URLs or URL patterns.

“It is not surprising that extensions tend to request more permissions than they need. The more permissions an extension has, the greater the attack surface,” the team said.

Not only that, the report also pointed out the worrying thing that extensions containing malicious software often have an average lifespan of up to 380 days before being detected and removed. According to Forbes , existing too long on the browser makes the risk of data being stolen even greater and more numerous.

In addition, the research team also said that as of May 2024, nearly 1% of all extensions installed on Google Chrome contained malware. According to statistics from the search giant, more than 250,000 extensions are available on the Chrome web store, more than any other browser.

Google also recommends four ways for users to reduce the risk of downloading malware. They should review the information that an extension collects before installing it; uninstall extensions that are no longer used; limit the websites that extensions can work on; and enable Enhanced Protection when browsing the web if needed.

According to Statcounter, as of May 2024, Google Chrome is still the dominant browser with more than 3.2 billion users. On computers, the browser has a market share of about 64.87%, far ahead of the next two positions: Microsoft Edge with 13.14% and Safari at 8.79%. On mobile devices, Chrome accounts for 65.94%, Safari is second with 23.47% and Samsung Internet 4.43%.

Source: https://baoquocte.vn/hang-tram-trieu-nguoi-dung-trinh-duyet-chrome-dinh-ma-doc-qua-extension-276452.html