Open your browser and count the little puzzle-piece icons in the toolbar. Now try to remember why each one is there. The coupon finder from 2021, the PDF tool you used once, the dark mode thing that stopped working. Every one of them can read what you do online.
Extensions are the part of your browser nobody manages, and they get hijacked. This tip covers a real case, a ten-minute audit, and a policy for the office.
A real case, on Christmas Day
On December 25, 2024, a malicious update went out for the Cyberhaven Chrome extension. According to a threat report from RH-ISAC, an administrator had been phished, which gave the attacker access to upload version 24.10.4 to the Chrome Web Store. The bad version was removed within 60 minutes of being discovered.
About 400,000 users were affected by that extension alone, and RH-ISAC describes it as part of a broader campaign hitting at least 16 Chrome extensions, with more than one million estimated infections in total. The malicious code exfiltrated cookies, session tokens, and credentials, and it mostly targeted logins to social media advertising and AI platforms.
The lesson is that even a legitimate, trusted extension can turn hostile overnight after an update.
The ten-minute audit
In Chrome or Edge, open the extensions page from the menu. For each one, ask three questions. Do I still use it? Do I know who publishes it? Does it really need permission to read and change data on all websites? Remove anything that fails the first question, and be skeptical of anything that fails the other two.
Fewer extensions means a smaller target. Most people can get down to two or three.
The office policy
Chrome and Edge both let administrators control which extensions employees can install. Start with a short approved list and block the rest. Anyone who needs something new asks first, and someone checks who publishes it and what it wants. That process takes minutes and closes a door that most small offices leave wide open.
The bigger lesson
Trust in software is not permanent. Updates can change what a tool does, so someone has to keep watching. That someone should not be the person trying to finish a spreadsheet, which is why we handle browser controls as part of our managed IT services.
Nobody manages the extensions in your browser until one goes bad. We set an approved list and keep watch so your team can just work. No pressure, no obligation, just a straight look at your setup.
Book a 10-Minute Discovery Call →Frequently asked questions
Can a browser extension really steal my logins?
Yes. In the December 2024 Cyberhaven extension compromise, the malicious code exfiltrated cookies, session tokens, and credentials to an attacker-controlled domain.
How many extensions is too many?
There is no magic number, but every extension is more access to what you do online. Keep only the ones you use regularly and can name a reason for.
Does multi-factor authentication protect me from this?
Not fully. If an attacker steals an active session token, they can act as you without needing your password or a code. That is why removing risky extensions and signing out of sessions matters too.
Can we block extensions company-wide?
Yes. Chrome and Edge both support administrator policies that limit which extensions can be installed. An approved list is the usual approach.
Can safemode IT manage extensions for our team?
Yes. We set the browser policies and handle exceptions. See our managed IT services or ask for a free assessment.
Source: RH-ISAC, Cyberhaven Extension Compromise Part of Broader Campaign
Last updated: November 5, 2026
