18 Chrome and Edge extensions that hijacked browsers after years of good behavior

Reported July 2025. Koi Security found 18 extensions, 10 in the Chrome Web Store and 8 in Edge Add-ons, with about 2.3 million installs. They worked as advertised for years, some with Featured or Verified badges, until updates added code that reported every page visited and could send the browser to sites the attackers chose.

Why trusted extensions turn

These extensions did what they promised for a long time and collected users, reviews and store badges. Then an update added the malicious code. Chrome and Edge install updates quietly, so people who had trusted them got it without doing anything.

What to do if you have one

  1. Open chrome://extensions (or edge://extensions) and remove any extension from the lists below.
  2. Change passwords you typed or saved in that browser, starting with email and banking, and turn on two-factor sign-in.
  3. Remove extensions you no longer use. Fewer extensions means fewer chances for this to happen again.

Extensions in the report (18)

Each Chrome link opens the extension's checker page, which shows whether it is still in the store.

Sources

What this page can't see

A store listing doesn't show what an extension can access on your computer, and it can't warn you later. Extensions get sold, and the next silent update can change everything.

Extension Guardian watches the extensions you have installed and warns you when one changes owner, gains new permissions or disappears from the store. Free, open source, no account.

Add to Chrome, it's free