37M Chrome Extensions Leak Browsing Data

• Researcher Q Continuum built an automated testing pipeline that launched Chrome instances, installed extensions, visited predefined websites, and captured outbound communications to identify data exfiltration patterns • Encrypted payloads were decoded to reveal raw Google search URLs, page referrers, user IDs, and timestamps being transmitted to proprietary domains and cloud-provider endpoints[4] • Extensions requested broad host permissions (cross-website access) enabling comprehensive browsing history collection[3] • Data collection infrastructure includes companies such as Similarweb, Big Star Labs (identified as a Similarweb subsidiary), Semrush, Alibaba Group, and ByteDance[1] • Similarweb's February 27, 2025 financial filing confirmed the company's reliance on data gathered from browser extensions and apps distributed through Chrome Web Store, Google Play, and Apple App Store[1] • A related cluster of 30 malicious extensions with over 260,000 installs employed advanced manipulation techniques including hidden iframe injection, real-time browser UI manipulation, tracking pixels, session data exfiltration, webpage content replacement, phishing overlays, and silent user redirection[2]

This discovery underscores critical vulnerabilities in the browser extension ecosystem and highlights the urgent need for enhanced security governance within app stores. The coordinated nature of the operation—involving 32 publishing entities and centralized data broker infrastructure—suggests that extension-based surveillance has become a systematic, profitable business model. Organizations face elevated risks of corporate espionage through employee browsing data exposure, while individual users confront privacy erosion and credential harvesting threats. The incident may accelerate regulatory scrutiny of extension permissions, data collection practices, and app store vetting procedures. Additionally, the sophisticated obfuscation techniques employed (AES-256 encryption, RSA-OAEP wrapping) indicate that malicious actors are investing in advanced evasion methods, potentially outpacing detection capabilities.