It's time to treat browser extensions like supply chain attack vectors

The report explains how a Context.ai browser extension and an infostealer installed on an employee device led to a supply-chain compromise that exposed an OAuth token and enabled a large-scale attack on Vercel; it warns that browser extensions (which auto-update silently and can hold broad privileges) are an underappreciated supply-chain risk and recommends applying dependency-style scanning, continuous auditing of installed extensions, and pre-install blocking tied to threat intelligence.