Browser Extensions: Are They Worth the Risk?
Summary: Mega.nz reported that an unknown attacker hacked its Chrome Web Store account and on 4 September 2018 at 14:30 UTC uploaded a trojaned version 3.39.4 of its Chrome extension, which requested elevated permissions and exfiltrated credentials for sites including amazon.com, live.com, github.com, myetherwallet.com and mymonero.com to a server in Ukraine. Krebs writes that compromised extensions can expose all data on a computer and the sites a user visits, and that most extensions carry Google's medium or high alert level.
Why it matters: An extension that auto-updates can turn malicious without any action from the user, and the permissions it already holds determine how much an attacker gets - in this case credentials for GitHub, Google, Amazon and two cryptocurrency wallets.
Read the original at Krebs on Security ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026