Malicious Browser Extensions: An Overlooked Security Threat

Browser extensions are effectively unmanaged SaaS applications that, if hijacked or malicious, can read DOM content, capture session tokens, log keystrokes, and exfiltrate data—bypassing IdP, EDR, and CASB defenses. The report cites real-world removals of compromised Chrome extensions affecting millions of users and a late-2024 CyberHaven breach where stolen OAuth tokens enabled stealthy account impersonation, and it recommends visibility, behavior-based risk scoring, session monitoring, and targeted user interventions to mitigate the risk.