At this point, someone should make a site to check whether installed extensions are malicious or not.
This website promises to do just that: https://webextension.org/ (formerly add0n.com)
Chrome extensions spying on users' browsing data
181–190 of 215 posts
Re: Chrome extensions spying on users' browsing data
#182At this point, someone should make a site to check whether installed extensions are malicious or not.
Why not do the opposite - a whitelist of extensions that don't appear malicious.
You've just reinvented curation, but giving Google a pass for not them doing it themselves and shifting the work onto others.
Multiple regulators should sue Google for putting users at risk by failing to protect users from malicious code before publishing Chrome extensions and Android apps.
Re: Chrome extensions spying on users' browsing data
#183Earlier quoted context omitted.
> The only extension I trust enough to install on any browser is uBlock Origin. Note however that the origin of uBlock Origin is that the developer Raymond Hill transferred control of the original uBlock project to someone who turned out not to be trustworthy, and thus Hill had to fork it later.
I never transferred the extension in the Chrome store. The Chrome store extension has always been the one from the repository I control, and I've had full control of it since when I created it back in June 2014.
Thank you for your work!
Re: Chrome extensions spying on users' browsing data
#184Re: Chrome extensions spying on users' browsing data
#185Earlier quoted context omitted.
Why not do the opposite - a whitelist of extensions that don't appear malicious.
You've just reinvented curation, but giving Google a pass for not them doing it themselves and shifting the work onto others. Multiple regulators should sue Google for putting users at risk by failing to protect users from malicious code before publishing Chrome extensions and Android apps.
A blacklist is also curation isn't it? Suing google is also 'work'.
Re: Chrome extensions spying on users' browsing data
#186If you're on a mac, you can list all the IDs of your installed browser extensions across all your profiles like this... find "$HOME/Library/Application Support/Google/Chrome" \ -type d -path "*/Extensions/*" -not -path "*/Extensions/*/*" \ -print 2>/dev/null | sed 's#.*/Extensions/##' | sort -u Compare to the list of bad extensions. I stuck a stripped down list here... https://www.sfbaylabs.org/files2/2026-02-11/chro…
Here's a one-shot script that does the compare for you, in case it's helpful... https://www.sfbaylabs.org/files2/2026-02-11/bad_browser_extension_check_osx.sh You can run it directly if you cut/paste this in your mac terminal... curl -fsSL https://www.sfbaylabs.org/files2/2026-02-11/bad_browser_extension_check_osx.sh | bash
Is there any irony in a thread on browser malware that includes a "please run this bash script blind"?
Not that I don't trust you, but between now and when someone stumbles on this thread, your domain could expire and I could publish something crazy at that url.
Re: Chrome extensions spying on users' browsing data
#187This is why I only run open source extensions that I can actually audit. uBlock Origin, SponsorBlock, the kind of tools where the code is available and the developer isn't anonymous. The Chrome Web Store is basically unregulated and Google doesn't care as long as they get their cut. Open source at least gives you a chance to see what you're installing before it starts exfiltrating your data to some server in a countr…
Do you also audit every part of every car you buy or medicine you take? Or do you rely on large well-established institutions to do that for you? "Dont trust google" imo is the wrong response here. We are at the mercy of our institutions, and if they are failing us we need mechanisms to keep them in check.
> "Dont trust google" imo is the wrong response here.
Straw man. The argument is that by installing random extensions you trust anonymous developers *because* Google doesn't audit. I'll cite the parent to spare you the effort of reading it again:
> The Chrome Web Store is basically unregulated and Google doesn't care.
Yes, I trust the contents of the medicine I buy at the drug store more than I trust the drug dealer on the corner. That's why they hand out test kits for free at raves.
Re: Chrome extensions spying on users' browsing data
#188Earlier quoted context omitted.
While assuming absolutely zero bad will on your part, I would nevertheless find it fair if you were legally on the hook for whatever happened after the sale, unless you could prove that you provided reasonable means for the users of your extension to perform their due diligence on the new owner of the extension. This is of course easy to say in hindsight, and is absolutely a requirement that should be enforced by the…
I wouldn't find that fair at all. Bad actors should be legally responsible for their bad action. If I sell you a taxi business, and then all of a sudden you decide to start robbing the customers - it's not my fault is it? And just to be clear, I had no idea if my extension was used for nefarious purposes, but in hindsight it probably was.
Customers were sold[1] a lifetime subscription to Honest Guy's taxis, and then Honest Guy does a secret deed to sell his taxi joint to Bad Guy[2] without telling any customer about it. Then customers start getting ripped of in all manner of ways, that some of them would have known to avoid if they knew their taxis were being run by Bad Guy.
[1] Of course, the issue here is that no contracts were signed.
[2] In the specific case I was replying to, there was no malice or intent to hide from you as seller. Yet, a better outcome could have been achieved by advertising the sale to those impacted.
I don't think there is any legal support for what I describe above, but in principle whenever a user signs up for Good Thing, and then gets baitswitched to Evil Thing, the main victim is the user, and it is fair to hold responsible everyone involved in the bait-and-switch maneuver.
Re: Chrome extensions spying on users' browsing data
#189Earlier quoted context omitted.
While assuming absolutely zero bad will on your part, I would nevertheless find it fair if you were legally on the hook for whatever happened after the sale, unless you could prove that you provided reasonable means for the users of your extension to perform their due diligence on the new owner of the extension. This is of course easy to say in hindsight, and is absolutely a requirement that should be enforced by the…
How would that even work? What if the seemingly clean buyer sells it to someone else scammy?
Disclose the sale to the users of the thing being sold. Plain and simple.