Extension Poisoning Campaign Highlights Gaps in Browser Security

A phishing attack on a Cyberhaven developer account allowed attackers to publish a malicious Chrome extension; researchers link this to two broader campaigns (one focused on stealing cookies/session tokens/credentials and another on telemetry/tracking) that affected dozens of extensions and an estimated 1.46 million users. The campaigns used phishing and a malicious OAuth application to take over developer accounts and distribute unauthorized updates between mid‑2023 and late‑2024; Google and researchers have removed many affected extensions and contained further spread but the incident highlights persistent browser-extension supply‑chain risks.