Hundreds of millions of Chrome browser users infected with malware via extensions

Up to 280 million Google Chrome browser users are facing security risks due to installing extensions.

Trong vòng 3 năm, đã có hơn 280 triệu lượt người dùng Chrome tải extension dính mã độc.

Over the past three years, more than 280 million Chrome users have downloaded malicious extensions.

Stanford University and the CISPA Helmholtz Center for Information Security have just released research showing that from July 2020 to February 2023, 346 million users installed malicious extensions. Of these, 280 million Google Chrome extensions contained malware, 63 million extensions violated policies, and 3 million extensions were vulnerable to attacks. At that time, there were nearly 125,000 extensions available in the Chrome Store.

The researchers collected the data by parsing each extension's *.json declaration file. These files were then broken down into Application Programming Interface (API) access requests such as storage, cookies, and servers such as URLs or URL patterns.

“It is not surprising that extensions tend to request more permissions than they need. The more permissions an extension has, the greater the attack surface,” the team said.

Not only that, the report also pointed out the worrying fact that extensions containing malicious software often have an average lifespan of up to 380 days before being detected and removed. According to Forbes , existing too long on the browser makes the risk of data being stolen even greater and more numerous.

In addition, the research team also said that as of May 2024, nearly 1% of all extensions installed on Google Chrome contained malware. According to statistics from the search giant, more than 250,000 extensions are available on the Chrome web store, more than any other browser.

Google also recommends four ways for users to reduce the risk of downloading malware. They should review the information an extension collects before installing it; uninstall extensions they no longer use; limit the websites an extension can run on; and enable Enhanced Protection when browsing the web if necessary.

According to Statcounter, as of May 2024, Google Chrome is still the dominant browser with more than 3.2 billion users. On computers, the browser has a market share of about 64.87%, far ahead of the next two positions, Microsoft Edge with 13.14% and Safari with 8.79%. On mobile devices, Chrome accounts for 65.94%, Safari is second with 23.47% and Samsung Internet 4.43%.

Source: https://baoquocte.vn/hang-tram-trieu-nguoi-dung-trinh-duyet-chrome-dinh-ma-doc-qua-extension-276452.html