35 Chrome Extensions That Look Harmless, but Are Secretly Spying on You

35 Chrome Extensions That Look Harmless, but Are Secretly Spying on You brings together practical options worth considering. Below, you'll find clear explanations, useful context, and tips for deciding which choices best match your needs.

Remove These 35 Chrome Browser Extensions Now!

Security researcher John Tuckner found a group of at least 35 extensions using the same pattern, connecting to some of the same servers and requesting the same list of sensitive system permissions. These extensions have a combined total of more than 4 million installs, and 10 of them even have a 'Featured' label on the Chrome Web Store—a badge reserved for verified developers you can trust.

Surprisingly, all but one of the extensions are not listed in the Chrome Web Store, meaning they don't appear in the Web Store or search results. It's unclear how they managed to amass such a large number of installs.

The full list of extensions is as follows:

• Better Browse by SecureSearch
• Bing Search by Securify
• Browse Securely for Chrome
• Browser Checkup for Chrome by Doctor.
• Browser WatchDog for Chrome
• Check My Permissions for Chrome.
• Choose Your Chrome Tools
• Cuponomia - Coupon and Cashback.
• Data Shield for Chrome
• Fire Shield Chrome Safety
• Fire Shield Extension Protection.
• Global search for Chrome
• In Site Search for Chrome
• Incognito Search for Chrome
• Incognito Shield for Chrome
• Map Search for Chrome
• MultiSearch for Chrome
• News Search for Chrome
• Privacy Guard for Chrome
• Private Search for Chrome
• Protecto for Chrome
• Safe Search for Chrome
• Securify Advanced Web Protection.
• Secure for Chrome
• Secure Kid Protection
• Secure Your Browser
• SecuryBrowse for Chrome
• Total Safety for Chrome
• Protecto's Unbiased Search
• Watch Tower Overview
• Web Privacy Assistant
• Web Results for Chrome
• Website Safety for Chrome
• Ghost's Yahoo Search

In a Secure Annex blog post, Tuckner makes clear that extensions claim to have a number of purposes, such as blocking ads, providing better search results, protecting privacy, and, ironically, protecting extensions. The underlying code to deliver their claimed purpose is often minimal or absent while this may help extensions get available in the Chrome Web Store.

All 35 extensions have obfuscated code, which is not a good sign from a security perspective as it hides the extension's behavior and slows down analysis. The extensions also have the unknown.com domain configured in their background services. The domain is unrelated to the underlying code, but it is useful for linking them.

They also request permissions that are beyond the scope of the specific extension's purpose, including:

• Tab management and interactive access.
• Ability to set and store browser cookies.
• Intercept and modify web requests.
• Store data persistently in the browser.
• Add JavaScript to web pages or manipulate their structure.
• Activate alert
• Interact with browser activity along with other permissions.

As you might expect, these permissions can give extensions many access to your browser and private data, potentially leading to quite serious breaches. Most extensions don't ask for such high-level permissions, meaning that even if they don't use their extensive access for malicious purposes, they still pose unnecessary risks.

This isn't the first security issue involving Chrome extensions. Millions of users have been affected by malicious Chrome extensions in the past. You should always check the safety of a Chrome extension before clicking that install button while Google takes Chrome's security seriously.

Final Thoughts

The most reliable way to handle chrome extensions that look harmless, but are secretly spying on you is to follow the process in order, verify each important setting, and test the result before moving on. Use the guidance above as a practical reference, then adjust the details for your device, software version, or specific goal.