Why Browser Extension Ownership Transfers are Enabling Malicious Code Injection

We’ve been tracking a pattern that most security teams still haven’t had time to internalize. Browser extensions are no longer just productivity tools that employees install and forget about. They’ve become dynamic components of your software supply chain, and the latest Chrome incidents prove the old approval-once model is broken.

Recently, two seemingly harmless extensions with thousands of combined users were sold to new owners, then turned malicious within days: 

• QuickLens – Search Screen with Google Lens; (ID kdenlnncndfnhkognokgfpabgkgehodd) 7,000 users
• ShotBird: Scrolling Screenshots, Tweet Images & Editor (ID – gengfhhkjekmlejbhmmopegofnoifnjp) 800 users

What Happened

Code injection, data theft, session hijacking. The users saw nothing change. The Chrome Web Store approved the updates. Security teams had no visibility into the ownership transfer.

This is the extension supply chain problem in a nutshell.

The Ownership Transfer Blind Spot

Here’s what we know from the data. Over 5.8 million users were directly impacted by documented malicious browser extensions in 2024-2025. The Cyberhaven attack alone affected approximately 400,000 users. Within 48 hours, all those corporate customers had auto-updated to compromised code.

The structural problem is simple. Chrome Web Store has minimal oversight for extension ownership transfers and updates. No ownership transfer review. No user notification. A malicious actor can buy a legitimate extension and weaponize it within 24 hours.

The ShadyPanda campaign spent seven years playing the long game. They published or acquired harmless extensions, let them run clean for years to build trust and gain millions of installs, then suddenly flipped them into malware via silent updates. About 4.3 million users installed these once-legitimate add-ons. Some even earned featured and verified badges in the official Chrome Web Store.

We’re not dealing with isolated incidents. We’re observing a repeatable attack pattern that exploits the gap between static approval processes and dynamic ownership reality.

AI-Driven Development Lowers the Barrier

The rise of AI-driven coding tools makes this problem worse, not better. What people are calling “vibe coding” lowers the barrier to producing and iterating on malicious features. An attacker who acquires an extension (or vibe code one from scratch) can now use AI to rapidly generate code variations, test evasion techniques, and deploy updates faster than manual review processes can catch them.

We should expect more of these cases, not fewer. The economics favor attackers. The technical barriers are dropping. The oversight mechanisms haven’t adapted.

Enterprise Attack Surface at Scale

The enterprise numbers tell the story. 95% of organizations experienced browser-based attacks last year. The average enterprise counts almost 1,500 browser extensions across its ecosystem, and 99% of enterprise users have at least one browser extension installed.

Analysis of 300,000 extensions found that 51% pose high security risks, while 60% haven’t been updated within 12 months. That’s approximately 350 million users exposed to security vulnerabilities through abandoned or outdated code.

Many malicious extensions specifically target enterprise users, corporate credentials, and sensitive business data. Extensions masquerading as enterprise productivity or access management tools target platforms like Workday, NetSuite, and SAP SuccessFactors, enabling session hijacking and full account takeover by abusing browser-level access.

Infected developer workstations mean compromised repositories and stolen API keys. Browser-based authentication to SaaS platforms, cloud consoles, and internal tools means every login is visible to a malicious extension with the right permissions.

Static Risk Programs Don’t Work Anymore

Most third-party and browser risk programs still treat extensions as static. You approve them once, maybe run a quarterly audit, and assume they remain safe. That model collapses when the developer behind an extension can change with a single marketplace update.

The Cyberhaven attack was detected in roughly 25 hours. A staged rollout with 48 to 72 hour delays would have contained it. But because Chrome and Edge updates occur automatically and do not require user re-approval for existing permissions, exploitation happens quietly.

We’ve learned from analyzing these incidents that the approval moment is less important than the ownership lifecycle. An extension that was safe yesterday becomes a new software vendor overnight when ownership transfers. Your security posture changes, but your visibility doesn’t.

Treat Ownership Changes as High-Signal Security Events

A more resilient approach is to treat extension ownership as a high-signal security event. Track when the developer identity changes. Alert security teams when it does. Where appropriate, automatically block or quarantine extensions that effectively become new software vendors overnight.

This requires continuous monitoring, not periodic audits. It requires treating browser extensions the same way you treat any other third-party software in your environment. It requires accepting that the browser is now a critical control plane for enterprise data access.

Solutions like SpinSPM, and SpinCRX are already helping organizations operationalize this pattern at scale, including recently released capabilities specifically designed to detect and alert on ownership transfers. They monitor ownership changes, track extension behavior over time, and enforce policies based on dynamic signals rather than static approvals. Security teams can move from reacting to headlines to getting in front of the next wave of extension supply chain abuse.

What This Means for Your Security Program

We’re seeing regulated organizations start to require continuous monitoring as a prerequisite for DPIA and contract negotiations. Enterprise buyers are adding it to security questionnaires. The shift is happening whether vendors are ready or not.

If you’re still running quarterly extension audits, you’re operating with a 90-day blind spot in a threat environment that moves in hours. If you’re not tracking ownership transfers, you’re trusting that marketplace operators will catch malicious updates before they reach your users. The data shows they won’t.

The browser extension supply chain is real. It’s dynamic. It’s exploitable. And it’s expanding as more enterprise workflows move into browser-based SaaS platforms.

Start treating extension ownership changes as security events. Implement continuous monitoring for your browser environment. Build policies that respond to ownership transfers, not just initial approvals. The organizations that adapt to this reality will avoid becoming the next headline.

Was this helpful?

Yes No