Full Report
A set of 57 Chrome extensions with 6,000,000 users have been discovered with very risky capabilities, such as monitoring browsing behavior, accessing cookies for domains, and potentially executing remote scripts. [...]
Analysis Summary
# Vulnerability: Hidden Tracking Code in Multiple Chrome Extensions
## CVE Details
- CVE ID: Not explicitly provided in the source material. This appears to be a supply chain/malware discovery rather than a single, specific CVE tracked flaw.
- CVSS Score: Not calculable/Not provided.
- CWE: Likely related to CWE-116 (Improper Encoding or Escaping of Output) or CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) due to hidden tracking logic.
## Affected Systems
- Products: Google Chrome Extensions (a collection of 57 extensions identified).
- Versions: All versions of the listed extensions prior to removal/updates.
- Configurations: Google Chrome browser users who have installed these extensions.
## Vulnerability Description
A security researcher (Tuckner) discovered that a large number of Chrome extensions (initially several, growing to 57, totaling an estimated 6 million installs) contained hidden, heavily obfuscated tracking and command-and-control (C2) capabilities. These extensions, many of which ostensibly offered simple security or utility functions (like coupon finding or protection), possessed dangerous capabilities, including:
1. Executing arbitrary functions via C2.
2. Listing the top sites visited by the user.
3. Opening and closing browser tabs.
The researcher labeled the behavior as risky and potentially spyware due to the excessive permissions sought and the hidden logic.
## Exploitation
- Status: Implied active C2 potential, but explicit "exploited in the wild" status is not confirmed. The capabilities suggest active collection, which qualifies as exploitation of user trust.
- Complexity: Medium (Requires execution via the extension framework, but the C2 setup suggests remote instruction capability).
- Attack Vector: Network (via communication with C2 infrastructure after installation).
## Impact
- Confidentiality: **High** (Potential for collection of browsing history and other site data).
- Integrity: **Medium** (Ability to open/close tabs suggests potential for interaction with user sessions or forced navigation).
- Availability: **Low** (No explicit impact on system uptime mentioned).
## Remediation
### Patches
- The article states that *many* of the risky extensions have been **removed from the Chrome Web Store** following the researcher's report. No specific patch version is available as the remediation is removal.
### Workarounds
1. Immediately uninstall any of the identified risky extensions.
2. Perform password resets on important online accounts as a precaution due to potential browsing history exposure.
**Key Risky Extensions Mentioned (Must be removed):**
* Cuponomia – Coupon and Cashback (700,000 users)
* Fire Shield Extension Protection (300,000 users)
* Total Safety for Chrome™ (300,000 users)
* Protecto for Chrome™ (200,000 users)
* Browser WatchDog for Chrome (200,000 users)
* Securify for Chrome™ (200,000 users)
* Browser Checkup for Chrome by Doctor (200,000 users)
* Choose Your Chrome Tools (200,000 users)
## Detection
- Indicators of Compromise: Unexpected browser tab manipulation, network activity to unknown domains upon extension load.
- Detection methods and tools: Reviewing Chrome extension permissions for any utility extension that requests excessive access, especially to browsing history or capability to modify tabs, and using tools that de-obfuscate extension code for forensic analysis.
## References
- Vendor advisories: Google is reportedly aware and investigating.
- Relevant links - defanged:
* [Secure Annex Blog Post on tracking code](secureannex.com/blog/searching-for-something-unknow/)
* [Researcher's tweet mentioning 22 more extensions](x.com/tuckner/status/1912616945284788246)
* [Complete list spreadsheet](docs.google.com/spreadsheets/d/1LN7MQ_9W5QHIyZjjqXK7JnSiCLlcF4aBRhmZKon-p4U/edit?gid=0#gid=0)
* [BleepingComputer Article](bleepingcomputer.com/news/security/chrome-extensions-with-6-million-installs-have-hidden-tracking-code/)