Google has removed 32 malicious extensions from its Chrome Web Store. These are able to change search results and spread spam or unwanted advertising. In total, the extensions have been downloaded more than 75 million times.
\nAs “Bleeping Computer” reports, the affected extensions have functions with which they can act unnoticed by the user.<\/p>\n
Even if the affected extensions have been removed from the Chrome Web Store, this does not mean that they will be automatically disabled or uninstalled. Users should therefore take action themselves and remove the extensions.<\/p>\n
Cybersecurity researcher Vladimir Palant became aware of the issue while looking at the PDF Toolbox extension. He discovered that it contained malicious code disguised as a legitimate extension API wrapper. According to Palant, this makes it possible to inject arbitrary JavaScript code into any website visited by the user.
\nThe potential for abuse ranges from displaying advertising on websites to stealing sensitive user data. The code was set to activate 24 hours after the extension was installed. A typical behavior of malware.<\/p>\n
Besides the PDF Toolbox extension, which has been downloaded 2 million times, other malware-infected extensions have been identified and have been removed from the Chrome Web Store.
\nSome examples are:
\nAutoskip for Youtube – 9 million users
\nSoundboost \u2013 6.9 million users
\nCrystal Ad Block – 6.8 million users
\nBrisk VPN \u2013 5.6 million users
\nClipboard Helper – 3.5 million users
\nMaxi Refresher – 3.5 million users
\nThe complete list of all affected apps can be found here.
\nAlthough Palant reported the affected extensions to Google, they remained available on the web store. Only when the security company Avast reported to Google and identified 13 extensions as malicious in addition to the 19 reported by Palant, did Google take action and remove the extensions from the web store.<\/p>\n","protected":false},"excerpt":{"rendered":"
Google has removed 32 malicious extensions from its Chrome Web Store. These are able to change search results and spread spam or unwanted advertising. In total, the extensions have been downloaded more than 75 million times. As “Bleeping Computer” reports, the affected extensions have functions with which they can act unnoticed by the user. Even …<\/p>\n","protected":false},"author":29,"featured_media":76698,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[167],"tags":[4384],"class_list":["post-76697","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-technology","tag-google"],"_links":{"self":[{"href":"https:\/\/www.nationalturk.com\/en\/wp-json\/wp\/v2\/posts\/76697","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.nationalturk.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.nationalturk.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.nationalturk.com\/en\/wp-json\/wp\/v2\/users\/29"}],"replies":[{"embeddable":true,"href":"https:\/\/www.nationalturk.com\/en\/wp-json\/wp\/v2\/comments?post=76697"}],"version-history":[{"count":2,"href":"https:\/\/www.nationalturk.com\/en\/wp-json\/wp\/v2\/posts\/76697\/revisions"}],"predecessor-version":[{"id":76700,"href":"https:\/\/www.nationalturk.com\/en\/wp-json\/wp\/v2\/posts\/76697\/revisions\/76700"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.nationalturk.com\/en\/wp-json\/wp\/v2\/media\/76698"}],"wp:attachment":[{"href":"https:\/\/www.nationalturk.com\/en\/wp-json\/wp\/v2\/media?parent=76697"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.nationalturk.com\/en\/wp-json\/wp\/v2\/categories?post=76697"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.nationalturk.com\/en\/wp-json\/wp\/v2\/tags?post=76697"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}