Chrome Store Features Extension Poisoned With Sophisticated Spyware

A trusted, widely downloaded Chrome extension providing color-picking functionality was poisoned via an update to include sophisticated spyware: a background service worker that tracks all visited URLs, maintains a persistent C2 channel, and can issue malicious redirects while still delivering the advertised features. Koi Security discovered the compromise the day of the update, notified Google, and recommends immediate removal, clearing browser data, full malware scans, and monitoring of accounts; the case highlights risks of extension poisoning and the need for stronger governance around browser extensions.