Malicious Chrome Extensions Skate Past Google's Updated Security

SquareX researchers demonstrated at DefCon 32 that malicious Chrome extensions can circumvent Google’s Manifest V3 safeguards to steal live video feeds, redirect users to phishing pages, manipulate GitHub access, and exfiltrate cookies and browsing history using overly broad host permissions. The article argues MV3’s permission model remains too permissive, while Google highlights enterprise controls, admin alerts, and risk assessment tools (CRXcavator, Spin.AI) amid the MV2-to-MV3 migration. Organizations are advised to audit installed extensions, limit permissions, and improve visibility and control over browser extensions.