Google has run into some fresh problems. A number of Andorid and Google chrome users might be facing problems using certain extensions because Google is currently in the midst of fixing some big errors.
This week, Google has removed over 500 Chrome extensions due to concerns that they were redirecting users to malicious sites and ad content without users being aware. The issue was identified by Cisco’s Duo security team. Explaining the matter, the security experts stated:
“Browser extensions have been known as a weak point for individual security and privacy due to their potential for misuse under the general guise of helpful applications. In the case reported here, the Chrome extension creators had specifically made extensions that obfuscated the underlying advertising functionality from users. This was done in order to connect the browser clients to a command and control architecture, exfiltrate private browsing data without the users knowledge, expose the user to risk of exploit through advertising streams, and attempt to evade the Chrome Web Store’s fraud detection mechanisms.”
In other words, users were being inadvertently re-directed to ads, in order for the developers behind the extensions to take a cut of that traffic. In interviews with impacted users, most reported being unaware of any obvious impacts on their browsing experience.
Millions of users are likely impacted by these removals. According to Duo, their initial investigation showed that almost 2 million users had downloaded the extensions it identified, but Google’s subsequent action based on information from Duo significantly expanded on this scope. It’s not clear exactly how many people have installed these extensions, but as noted, if you try out an extension and it no longer works, this could be why.
It’s not the first time Google Chrome extensions have been used for such purpose. As reported by ZDNet, typically, this type of fraud involves injecting ads within a browsing session, but the developers try to hide such in order to avoid detection. In a more concerning attack, back in 2018, groups used Chrome extensions to steal login credentials, mine cryptocurrencies, and engage in click fraud, roping in more than 100,000 users.Given this, it’s worth double-checking that your extensions come from reputable sources.
