Malicious Browser Extensions

Browser extensions request permissions and users grant them without reading. For crypto users this is one of the most direct routes to a loss.

What a permissive extension can do

Read and modify page content. The most commonly requested permission. It allows an extension to alter what a page displays, including a destination address shown by a web interface.

Read clipboard data. Enables address substitution.

Intercept network requests. See and modify traffic between the page and its backend.

Inject scripts. Run arbitrary code in the context of any page you visit.

Any one of these is sufficient to attack a crypto user.

The attacks

Address substitution. The extension replaces a destination address in the page or in the clipboard. The user checks the first and last characters, which match, and sends.

Interface manipulation. A transaction is presented as one thing and constructed as another. The user approves what they read rather than what is signed.

Credential harvesting. Exchange logins captured as typed.

Seed phrase capture. If a user ever types a phrase into a browser, an extension with page access can read it.

How malicious extensions reach users

Direct publication. Submitted to the store, approved, and functioning normally until an update adds the malicious behaviour.

Acquisition. A legitimate extension with an existing user base is bought, and an update introduces the payload. Users already trusted it and updates are automatic.

Impersonation. An extension named to resemble a popular wallet or tool.

The acquisition route is the hardest to defend against, because the extension was genuinely trustworthy when installed.

The defences

Audit installed extensions. Remove anything not actively used. Most people have several they have forgotten.

Check permissions. An extension that changes tab colours does not need to read and modify all page content.

Use a separate browser profile for crypto, with only the wallet extension installed and nothing else.

This is the single most effective measure and it costs nothing.

Verify addresses on a hardware wallet screen. The device displays the destination independently of the browser, which defeats both interface manipulation and clipboard substitution.

Never type a recovery phrase into a browser. Restore on the device itself.

The thing that makes this category persistent

Extensions update automatically. An extension that is safe today can be malicious next week, through an update you did not review, published by an owner who may have changed.

Auditing periodically is therefore not optional, and the separate profile limits the damage when the audit misses something.

For the working balance

An exchange account is reachable through credential theft rather than signature manipulation, which is a different attack surface with different defences: hardware two-factor and a withdrawal address allowlist.

Both are offered by venues such as an exchange you can actually contact and both are off by default, which is the recurring theme of everything on this site.