--- title: Spying Chrome Extensions: 287 Extensions spying on 37M users description: Security researchers built an automated scanning pipeline using Docker, MITM proxies, and correlation analysis to detect browser history exfiltration in Chrome... canonical: https://daily.dev/posts/spying-chrome-extensions-287-extensions-spying-on-37m-users-zc89tp8r9 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Spying Chrome Extensions: 287 Extensions spying on 37M users | daily.dev og:description: Security researchers built an automated scanning pipeline using Docker, MITM proxies, and correlation analysis to detect browser history exfiltration in Chrome... og:url: https://daily.dev/posts/spying-chrome-extensions-287-extensions-spying-on-37m-users-zc89tp8r9 og:image: https://api.daily.dev/og/posts/ZC89tP8r9.png og:image:alt: Spying Chrome Extensions: 287 Extensions spying on 37M users og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Spying Chrome Extensions: 287 Extensions spying on 37M users **[Hacker News](https://daily.dev/sources/hn)** · 17 min read · 0 upvotes · 0 comments ## Summary Security researchers built an automated scanning pipeline using Docker, MITM proxies, and correlation analysis to detect browser history exfiltration in Chrome extensions. The scan identified 287 extensions with ~37.4M users that leak browsing data to third parties including Similarweb, Curly Doggo, and Offidocs. The report includes technical details of the detection methodology, decryption examples showing how extensions obfuscate exfiltrated data (ROT47, AES-256, LZ-string compression), and honeypot evidence linking specific actors. Affected extensions range from ad blockers to productivity tools, with data being sold to analytics firms and potentially enabling corporate espionage. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [260K\+ Chrome Users Duped by Fake AI Browser Extensions](https://daily.dev/posts/260k-chrome-users-duped-by-fake-ai-browser-extensions-ftkuwa8pg) · Dark Reading · 0 upvotes · 0 comments --- Tags: [#devtools](https://daily.dev/tags/devtools), [#google-chrome](https://daily.dev/tags/google-chrome), [#privacy](https://daily.dev/tags/privacy), [#reverse-engineering](https://daily.dev/tags/reverse-engineering), [#security](https://daily.dev/tags/security) [View this post on daily.dev](https://daily.dev/posts/spying-chrome-extensions-287-extensions-spying-on-37m-users-zc89tp8r9) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Spying Chrome Extensions: 287 Extensions spying on 37M users","url":"https://daily.dev/posts/spying-chrome-extensions-287-extensions-spying-on-37m-users-zc89tp8r9","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/spying-chrome-extensions-287-extensions-spying-on-37m-users-zc89tp8r9"},"datePublished":"2026-02-11T12:56:14.855Z","dateModified":"2026-03-15T05:31:46.058Z","description":"Security researchers built an automated scanning pipeline using Docker, MITM proxies, and correlation analysis to detect browser history exfiltration in Chrome...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/f6e3da51316f4b9ff69dea728f3a89b9?_a=AQAEunF","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/f6e3da51316f4b9ff69dea728f3a89b9?_a=AQAEunF","isAccessibleForFree":true,"articleSection":"Hacker News","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Hacker News","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/hn","url":"https://daily.dev/sources/hn"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/spying-chrome-extensions-287-extensions-spying-on-37m-users-zc89tp8r9","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"devtools,google-chrome,privacy,reverse-engineering,security","timeRequired":"PT17M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Hacker News","item":"https://daily.dev/sources/hn"},{"@type":"ListItem","position":3,"name":"Spying Chrome Extensions: 287 Extensions spying on 37M users"}]} ```