Socket Identified 19 Malicious Chrome and Edge Extensions

Researchers at Socket identified malicious extensions for Chrome and Microsoft Edge. There are 19 add-ons in total—18 for Chrome and one for Edge—which, according to their technical analysis, shared a mechanism for communicating with attackers’ servers and downloading additional malicious modules.

This is not merely a theoretical vulnerability issue. Socket describes a campaign in which affected versions of the extensions could steal passwords, form contents, browsing data, active sessions and crypto wallet-related data. One of the identified extensions has already been removed from the Chrome Web Store, while the status of the related version in the Microsoft Edge Add-ons catalog had not been independently confirmed as of August 30.

Malicious extensions used modules downloaded at runtime

According to Socket, the extensions first interfered with the security policies of visited websites. They removed Content Security Policy headers, which help restrict the loading and execution of untrusted content. They could then inject their own scripts into websites.

Other functions were not supposed to be located directly in the add-on’s core code. According to the analysis, the extensions downloaded them via WebSocket from servers controlled by attackers. This modular approach allows the malware’s capabilities to be changed or expanded without requiring a new update available in the extension store.

Socket documented 16 modules. Their functions included stealing form data and browsing history, abusing crypto exchange sessions, and phishing for recovery phrases from hardware crypto wallets. The mechanisms also included ClickFix-style lures that may prompt users to run a command in the operating system.

Five add-ons reportedly changed owners before the malicious update

Researchers said that five of the captured extensions had been purchased from their original authors, and the malicious code was added only in a subsequent update. According to their conclusion, the campaign’s actor created the remaining extensions.

This approach illustrates the risk posed by add-ons that may initially appear trustworthy or already have an established user base. An extension’s automatic update can deliver new code without the user reinstalling the add-on. At the same time, attackers did not need to include all malicious functions directly in the version that passed publication in the store.

Socket identified “Enable Right Click & Copy — Smart Unlock + OCR” as the add-on removed from the Chrome Web Store. As of August 27, according to the researchers, its related Edge version remained active; the company reported it to Microsoft. Independent confirmation of the item’s current status as of August 30 was not available.

The number of affected users is unknown

It has not been confirmed how many people installed the malicious versions or whether, and to what extent, accounts, data or cryptocurrency were stolen. Socket estimated potential exposure at approximately 80,000 users based on the number of users of two extensions. However, this figure does not represent the number of victims.

Likewise, attributing all 19 add-ons to a single actor and the possible connection to older activity dating back to February 2024 are Socket’s analytical conclusions, not publicly confirmed findings by law enforcement authorities.

What users should do

Users who have any of the identified extensions installed should remove them. Given the malware’s documented capabilities, it is advisable to change passwords from a trusted device and invalidate active sessions for affected services.

If a crypto wallet is suspected of being compromised, users should follow its provider’s security guidance. Further developments will also depend on whether Microsoft confirms the removal of the Edge version and whether independently verified cases of abuse or new indicators of compromise emerge.

Verified and updated: 08/30/2026 16:59