They are quick and easy to install – and can be just as quick to transmit data to third parties. We are talking about browser extensions. Whether in Google Chrome, Microsoft Edge, or Mozilla Firefox, many employees store their business credentials directly in their browsers or install extensions for AI applications, translation tools, or PDF documents without taking a closer look at what they are installing.
What many people fail to realize is that browser extensions can have extensive access permissions, making them a significant security risk.
Extensions that are allowed to read or modify the content of every website a user visits are particularly concerning. Depending on their permissions, malicious or compromised extensions can extract confidential business information from active browser sessions.
In February 2025, security researchers identified at least 16 malicious Chrome extensions with more than 3.2 million downloads. In March 2026, Microsoft confirmed that malicious extensions had been downloaded more than 900,000 times from the Chrome Web Store. Their names and descriptions closely resembled those of well-known AI applications. Collected data, including browsing activity and AI conversations, was regularly transmitted to external servers.
One thing needs to be made clear: Just because an extension or application is available in an official Microsoft or Google store does not mean it is safe. Anyone with a developer account and basic AI-assisted coding skills can publish an application in an official app store. Despite the security reviews conducted by platform operators, attackers repeatedly manage to distribute malicious applications or compromise legitimate developer accounts.
If employees store their credentials in a browser or enter them while a malicious extension is active, attackers may, under certain circumstances, gain access to login credentials or information from active authenticated sessions. In addition, so-called infostealers – specialized malware designed to steal sensitive data – can extract stored passwords, session cookies, and other confidential information directly from an endpoint.
If attackers succeed in hijacking a valid authenticated session, they may even be able to bypass two-factor authentication (2FA) without knowing the actual password.
How can businesses protect themselves? There are dedicated tools that allow organizations to centrally manage and approve browser extensions. Group Policy can also be used to define which extensions employees are permitted to install and use. This enables businesses to block unauthorized extensions across the entire organization.
