--- title: Browser Extensions Are the New Malware Dropper | daily.dev description: Browser extensions pose a serious and underappreciated security threat because they run inside the browser sandbox, bypassing traditional AV/EDR tools... canonical: https://daily.dev/posts/browser-extensions-are-the-new-malware-dropper-8rxy2hs4d twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Browser Extensions Are the New Malware Dropper | daily.dev og:description: Browser extensions pose a serious and underappreciated security threat because they run inside the browser sandbox, bypassing traditional AV/EDR tools... og:url: https://daily.dev/posts/browser-extensions-are-the-new-malware-dropper-8rxy2hs4d og:image: https://api.daily.dev/og/posts/8rxY2HS4D.png og:image:alt: Browser Extensions Are the New Malware Dropper og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Browser Extensions Are the New Malware Dropper **[InfoSec Write-ups](https://daily.dev/sources/infosecwriteups)** · 6 min read · 0 upvotes · 0 comments ## Summary Browser extensions pose a serious and underappreciated security threat because they run inside the browser sandbox, bypassing traditional AV/EDR tools entirely. A malicious extension can silently steal session cookies (bypassing MFA), intercept all HTTP requests, inject JavaScript into any webpage, and persist across reboots automatically. Real-world cases include The Great Suspender (2M users), DataSpii (2019), ChromeLoader (2022), and the Cyberhaven supply chain breach (2024). Defenders should audit installed extensions via MDM, maintain allowlists, use tools like CRXcavator and ExtAnalysis, and treat extensions as third-party software. Key permission red flags include cookies, webRequest, scripting on all URLs, and tabs access. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Newly discovered malicious extensions could be lurking in enterprise browsers](https://daily.dev/posts/newly-discovered-malicious-extensions-could-be-lurking-in-enterprise-browsers-i20gceevx) · CSO Online · 0 upvotes · 0 comments - [Why browser extensions are a major security risk and what you can do about it](https://daily.dev/posts/why-browser-extensions-are-a-major-security-risk-and-what-you-can-do-about-it-uo10mzxal) · Aikido Security · 1 upvotes · 0 comments - [Spying Chrome Extensions: 287 Extensions spying on 37M users](https://daily.dev/posts/spying-chrome-extensions-287-extensions-spying-on-37m-users-zc89tp8r9) · Hacker News · 0 upvotes · 0 comments - [A Browser Extension Risk Guide After the ShadyPanda Campaign](https://daily.dev/posts/a-browser-extension-risk-guide-after-the-shadypanda-campaign-op0egqjnb) · The Hacker News · 0 upvotes · 0 comments --- Tags: [#cyber](https://daily.dev/tags/cyber), [#devtools](https://daily.dev/tags/devtools), [#malware](https://daily.dev/tags/malware), [#web-security](https://daily.dev/tags/web-security) [View this post on daily.dev](https://daily.dev/posts/browser-extensions-are-the-new-malware-dropper-8rxy2hs4d) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Browser Extensions Are the New Malware Dropper","url":"https://daily.dev/posts/browser-extensions-are-the-new-malware-dropper-8rxy2hs4d","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/browser-extensions-are-the-new-malware-dropper-8rxy2hs4d"},"datePublished":"2026-04-23T06:54:15.308Z","dateModified":"2026-04-23T06:54:43.148Z","description":"Browser extensions pose a serious and underappreciated security threat because they run inside the browser sandbox, bypassing traditional AV/EDR tools...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/ee15f58388a99db30bab6353c0a390c7?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/ee15f58388a99db30bab6353c0a390c7?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"InfoSec Write-ups","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"InfoSec Write-ups","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/f0dc21b5bbfd46fda36f7b4b53dd1705","url":"https://daily.dev/sources/infosecwriteups"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/browser-extensions-are-the-new-malware-dropper-8rxy2hs4d","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"cyber,devtools,malware,web-security","timeRequired":"PT6M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"InfoSec Write-ups","item":"https://daily.dev/sources/infosecwriteups"},{"@type":"ListItem","position":3,"name":"Browser Extensions Are the New Malware Dropper"}]} ```