The attack is in the update. So is the evidence.
An extension is third-party code with standing access to corporate data, and it changes without notice. Six mechanisms, each shown rather than asserted.
Most compromised extensions do not begin as malware.
Building hostile code from scratch means facing the store review. Attackers skip it. A developer publishes something genuinely useful, spends years earning a trusted install base, and then the account is compromised or quietly sold. The asset changes hands. Every browser that already trusted it keeps trusting it.
- Ownership transfers to a party nobody reviewed
- The listing, rating, and install base carry over intact
- A later release ships behaviour the original author never wrote
Auto-update carries the payload past the perimeter.
Browsers update extensions in the background, without a prompt and without a review. One release reaches every enrolled profile that already trusted the publisher — so the window between weaponization and enforcement is the whole exposure.
- No user action, no install prompt, no second review
- Network perimeter controls never see the delivery
- Closing that latency gap is the security value
Read one version and you learn nothing. Read the change and you learn everything.
A single version in isolation carries no evidence of a breach, because a compromised extension asks only for what sounds plausible. Comparing consecutive releases isolates the moment the behaviour moved — a tool that never needed network access suddenly demanding it.
- Version-to-version structural diff of the shipped code
- Escalation measured against the extension’s own history
- Release cadence weighed against the publisher’s own baseline
Attackers rarely build bespoke malware. They rebrand and reuse.
One malicious framework is reskinned across hundreds of unrelated listings and publisher accounts. A permission-set fingerprint groups them, so a new upload that shares DNA with a previously removed cluster resolves to the same risk — under a new name, a new publisher, and a clean review history.
- A fingerprint computed from the permission signature
- New uploads compared against clusters of removed threats
- Clones surface without needing to match on name or ID
Every discovery source feeds the same risk engine.
Deploy the companion agent for depth, connect Microsoft Entra or Google Workspace for breadth, or run both. Whatever the source, every extension leaves with the same three-state verdict, and the methodology behind it is published rather than black-boxed.
- Permissions, manifest, publisher identity, and code patterns
- Scored again whenever a version changes, not once at install
- Feature importances published, so a verdict can be challenged
Start silent. Tighten when the data is in.
Policy evaluates server-side and resolves to allow, warn, or block per extension — but the rollout is yours to pace. Report-only changes nothing for a single user while verdicts accumulate, so the exception list writes itself from real usage before anything is ever blocked.
- Report only — learn what the fleet is actually running
- Warn — risky installs surface with their owners
- Enforce — by now the population is known and the change is uneventful
Trust cannot be assumed. It has to be continuously verified.
In an ecosystem defined by automatic updates and anonymous ownership, a one-time scan is not a control. Extension Auditor re-evaluates every extension whenever it changes state, and carries the verdict into the browser.