Browser Extensions Pose Heightened, but Manageable, Security Risks

The report outlines the growing security and privacy risks posed by browser extensions: attackers can abuse elevated permissions to exfiltrate credentials, session cookies, and other sensitive data. It cites incidents such as a malicious Chrome extension targeting Facebook Ads accounts and LayerX’s research on "malicious sleeper agent" extensions, highlights a broad attack surface driven by widespread extension usage and lax publisher vetting, and recommends user education, policy enforcement, and extension auditing to reduce enterprise risk.