Browser extension supply chain

Chrome and Edge auto-update means a bought extension can turn hostile overnight. Inventory, least privilege, and remove what you do not need.

Browser extensions are a software supply chain with a silent auto-update path. Socket's August 2026 Superior write-up is the current case study: researchers found 18 Chrome extensions and one Edge add-on delivering a modular malware framework. Five of those listings had been acquired from their original creators and later pushed malicious updates to an existing user base. One right-click utility had around 70,000 Chrome users when the hostile code landed.

The tradecraft is operational, not exotic. A useful extension ships clean, builds trust, then a later update establishes encrypted WebSocket command-and-control, strips Content Security Policy headers on every page, and injects modules that drain crypto wallets, steal credentials and history, harvest social accounts, or show ClickFix-style 'paste this update' prompts. Google removed the Chrome listings Socket named; treat any matching Edge copy as hostile until proven otherwise.

Defender work is inventory first. List every extension on managed browsers (Chrome, Edge, and the managed store). Prefer an allow list over 'users can install anything'. Strip broad permissions (all sites, clipboard, native messaging) that a note-taking or colour-picker tool does not need. Disable auto-update only if you have a tested enterprise update channel; otherwise you trade malware risk for unpatched bugs.

When a listing turns bad, assume credential theft. Force password and session rotation for high-value accounts, move crypto to a newly generated wallet, and hunt for ClickFix-style command execution on endpoints. Do not leave 'temporarily useful' extensions installed on privileged workstations. The same third-party rule as cloud and RMM applies: you can outsource the feature, you cannot outsource the risk.

Sources for the Superior case: Socket Threat Research (27 August 2026) is the primary technical write-up with extension IDs and C2 detail. BleepingComputer's 30 August summary is secondary. Pair this page with Third-party and supply chain for the broader outsourcing pattern.