Malicious Browser Extension.

A browser add-on that abuses its host permissions to steal credentials, hijack sessions, inject ads, or exfiltrate user data, often through compromised updates of legitimate extensions. It belongs to the Application Security category of cybersecurity.

A browser add-on that abuses its host permissions to steal credentials, hijack sessions, inject ads, or exfiltrate user data, often through compromised updates of legitimate extensions.

Malicious browser extensions are add-ons (Chrome, Edge, Firefox, Safari) that abuse the broad permissions extensions are typically granted — read/modify all sites, access cookies, capture network requests, inject content scripts — to perform attacks far beyond a normal web page. Common patterns include credential and cookie theft, session hijacking, ad injection, search-engine hijacking, cryptominer drop, and exfiltration of corporate SaaS data. Extensions often turn malicious through supply-chain attacks: a developer's account is compromised, an extension is sold to a malicious actor, or a benign dependency is replaced. Defenses include allow-listing extensions in enterprises, monitoring permission changes, using Manifest V3 origin restrictions, and removing unused extensions.

Defences for Malicious Browser Extension typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: Browser extension malware, Rogue extension.