Chrome extensions spying on users' browsing data

Post by revicon » Wed, Feb 11, 2026, 6:39 PM UTC

  find "$HOME/Library/Application Support/Google/Chrome" \
    -type d -path "*/Extensions/*" -not -path "*/Extensions/*/*" \
    -print 2>/dev/null | sed 's#.*/Extensions/##' | sort -u

  https://www.sfbaylabs.org/files2/2026-02-11/chrome_extensions_exfiltrating_history.txt

Post by gorhill » Wed, Feb 11, 2026, 6:51 PM UTC

lapcat wrote: post #85

matheusmoreira wrote: post #4

And the ones that are not will probably get bought out at some point and become malware as well. The only extension I trust enough to install on any browser is uBlock Origin.

> The only extension I trust enough to install on any browser is uBlock Origin. Note however that the origin of uBlock Origin is that the developer Raymond Hill transferred control of the original uBlock project to someone who turned out not to be trustworthy, and thus Hill had to fork it later.

Post by [deleted] » Wed, Feb 11, 2026, 6:59 PM UTC

deanc wrote: post #174

Rygian wrote: post #150

Earlier quoted context omitted.

While assuming absolutely zero bad will on your part, I would nevertheless find it fair if you were legally on the hook for whatever happened after the sale, unless you could prove that you provided reasonable means for the users of your extension to perform their due diligence on the new owner of the extension. This is of course easy to say in hindsight, and is absolutely a requirement that should be enforced by the…

I wouldn't find that fair at all. Bad actors should be legally responsible for their bad action. If I sell you a taxi business, and then all of a sudden you decide to start robbing the customers - it's not my fault is it? And just to be clear, I had no idea if my extension was used for nefarious purposes, but in hindsight it probably was.

Post by Chris2048 » Wed, Feb 11, 2026, 7:20 PM UTC

Rygian wrote: post #150

deanc wrote: post #21

Over 15 years ago now, I had a popular chrome extension that did a very specific thing. I sold it for a few thousand bucks and moved on. It seemed a bit strange at the time, and I was very cautious in the sale, but sold it and moved on. It's abundantly obvious to me now that bad actors are purchasing legitimate chrome extensions to add this functionality and earn money off the user's data (or even worse). I have seen…

While assuming absolutely zero bad will on your part, I would nevertheless find it fair if you were legally on the hook for whatever happened after the sale, unless you could prove that you provided reasonable means for the users of your extension to perform their due diligence on the new owner of the extension. This is of course easy to say in hindsight, and is absolutely a requirement that should be enforced by the…

Post by karel-3d » Wed, Feb 11, 2026, 7:35 PM UTC

cess11 wrote: post #62

l72 wrote: post #30

The fact that most of these are capturing query parameters: "u": "https://www.google.com/search?q=target", indicates that are capturing tons of authentication tokens. So this goes way beyond just spying on your browser history.

If a service is sending auth tokens as URL parameters, stop using it. Those are always public.