Field Notes.
News and updates about the platform
- 11
- 7
- 2025
Identifying Malicious Browser Extensions
Our Risk Engine scores 1.4M Chrome extension versions and hits 97% recall globally — but on extensions in the 6-to-12-month window, recall drops to 71%. Here's how the engine works, why that gap matters, why our existing layers don't fully close it, and what we're shipping next.
Read the post
I Quit My Job After the Cyberhaven Breach. Here's What I've Been Building.
14 months ago, the Cyberhaven Chrome extension breach exposed a massive blind spot in enterprise security. I quit my job and started building Extension Auditor. Here's the story.
We Scanned 534,000 Chrome Extensions. Here's What We Found.
We analyzed over 534,000 Chrome extensions and 1.3 million versions. The numbers on permissions, removal rates, and dangerous access patterns paint a troubling picture for enterprise security.
What Security Teams Do Today vs. What Extension Auditor Does
Most security teams handle browser extensions with spreadsheets, manual reviews, and hope. Here's what that looks like vs. continuous automated monitoring with Extension Auditor.
Your Company Reviews Code PRs but Blindly Installs Browser Extensions. Make It Make Sense.
Every code change gets a PR review. Every vendor gets a security questionnaire. But browser extensions with full page access? Installed with zero oversight. The double standard is indefensible.
Browser Extension Security Policy for Enterprise
A complete guide to creating and implementing a browser extension security policy for your organization. Includes ready-to-use policy templates, Chrome Enterprise configurations, approval workflows, and compliance mappings.
How Attackers Compromise Browser Extensions
A technical analysis of how attackers compromise legitimate browser extensions—from developer account takeovers to malicious updates. Learn the attack patterns, study real cases, and understand how to defend your organization.
Chrome Extension Permissions Explained
A comprehensive guide to every Chrome extension permission, what each one allows, the real security risks, and how to evaluate whether an extension needs the permissions it requests.
The Cyberhaven Chrome Extension Breach
On Christmas Eve 2024, attackers compromised Cyberhaven's Chrome extension and pushed a malicious update to 400,000+ users. Here's exactly what happened, the attack timeline, and how to prevent this from happening to your organization.
How to Check Your Chrome Extensions for Hidden Threats
Browser extensions simplify our lives but can hide security risks. I found that many Chrome users install extensions without knowing these add-ons often access their browsing data and personal information extensively.