How to Audit Browser Extensions for Supply-Chain Risk - Cyber Kendra
Browser extensions represent one of the most overlooked supply-chain risks in modern computing, as they update silently, can change owners, and often have permission to read every page users open.
Most people install browser extensions quickly for small tasks and then forget about them. However, these extensions aren't static pieces of software—they update silently, can change owners, and often have permission to read every page users open. This makes them significant supply-chain risks for both individuals and organizations.
Why Extensions Are Risky
Browser extensions are ideal vehicles for software supply-chain attacks because they update automatically. Once installed, an extension receives background updates that can push malicious versions to all users within hours without any action on their part.
Popular extensions with large user bases are valuable assets that developers sometimes sell. When ownership changes, the new owner inherits all existing user trust. The Great Suspender, a widely used tab management extension, was removed from the Chrome Web Store in 2021 after changing ownership and being flagged by Google as containing malware.
In December 2024, attackers phished developers of several legitimate Chrome extensions, including one from security company Cyberhaven, and used their access to push malicious updates designed to steal session data and credentials, with Facebook advertising accounts among the main targets.
Extension Permissions
When installing extensions, users often overlook permission prompts. The most common and powerful permission is "Read and change all your data on all websites," which allows extensions to read every page visited, see form fields as typed, access cookies and session data, and modify pages or inject scripts.
While many legitimate extensions need broad access to function, this makes compromised ones particularly dangerous. Browser vendors are responding with measures like Chrome's Manifest V3, which restricts extensions from loading remotely hosted code, and browsers like Afina that cryptographically sign extensions and encrypt profile data.
Auditing Extensions
Users can audit their browser extensions in about 15 minutes by listing everything installed, removing unused extensions, checking permissions for remaining ones, verifying the publisher hasn't changed, reading recent reviews, and separating sensitive activities into dedicated browser profiles with minimal extensions.
For organizations, extensions represent a shadow IT problem. Effective controls include using allowlists, centrally controlling permissions, regularly reviewing approved extensions, isolating high-value access, and including extensions in incident response plans.
Warning Signs
Compromised extensions may show warning signs including new ads or redirects appearing unexpectedly, changes to search engines or homepages, sudden requests for new permissions after updates, unexpected logouts or security alerts, or the extension disappearing from official stores after malware reports.
If any warning signs appear, users should remove the extension, sign out of active sessions on important accounts, change passwords for services used in that browser, and review recent account activity. Regular audits help close one of the easiest doors attackers have into user accounts.
Related
