Chrome extensions with 6 million installs have hidden tracking code

A set of 57 Chrome extensions with 6,000,000 users have been discovered with very risky capabilities, such as monitoring browsing behavior, accessing cookies for domains, and potentially executing remote scripts. These extensions are 'hidden,' meaning they don't show up on Chrome Web Store searches, nor do search engines index them, and can only be installed if the user has the direct URL. Typically, such extensions are private software like internal company tools or add-ons still under development. Still, threat actors might be using them to evade detection while aggressively pushing them through ads and malicious sites. The extensions were discovered by Secure Annex researcher John Tuckner, who uncovered the first 35 after examining what he claims is a suspicious extension named 'Fire Shield Extension Protection.' The extension is heavily obfuscated and contains callbacks to an API for sending information collected from the browser. Through a domain called "unknow.com" contained in the extension, Tuckner found additional extensions containing the same domain that claim to provide ad-blocking or privacy protection services. However, all of these include overly broad permissions allowing them to perform the following actions: While Tuckner didn't catch any extensions stealing user passwords or cookies, the excessively risky capabilities, heavily obfuscated code, and hidden logic were enough for the researcher to label them as risky and, potentially, spyware. "There are addit...