Browsers & Accounts · Extensions: Helpful or Harmful · Lesson 2 of 5

When Good Extensions Go Bad

How trusted extensions turn harmful, and why stars and reviews can fool you.

Sold, Then Changed

An extension can be safe on the day you install it and harmful months later. Knowing how that happens helps you stay alert.

Extensions update on their own. An update is a new version sent by the maker. Updates usually fix problems or add features. You are not asked each time, and you rarely notice.

That is helpful when the maker is honest. But the person sending updates can change.

Makers sometimes sell a popular extension. The buyer gets the extension and all its users. Some buyers are honest. Others buy it for the users, then send an update with hidden code that tracks people or shows them extra ads.

This has really happened. A tab-saving extension called The Great Suspender had millions of users. In 2020 its maker passed it to a new owner. Security researchers found the new versions could run code from an unknown server. In February 2021 Google removed it from the Chrome Web Store and turned it off in people's browsers, saying it contained malware.

In 2025, researchers at Koi Security reported 18 extensions for Chrome and Edge with about 2.3 million users. They looked like normal tools, such as color pickers and volume boosters. Most started out clean. Spying code was added later in updates. Some even had a verified badge or were featured in the store. Google said it removed them.

So what can you do? Watch for changes in behavior. Signs include:

• New ads or pop-ups that weren't there before.
• Your search engine or home page changing.
• The browser asking you to approve new permissions for an old extension.

If you see any of these, remove the extension. You can always find a safer one later.

Copycats and Fake Reviews

Another trick is the copycat extension. It is a fake that copies the name, logo and description of something popular, so people install it by mistake.

Here is a real example. In March 2023, the security company Guardio found a fake extension called Quick access to Chat GPT in the Chrome Web Store. It was promoted with paid ads in search results. It did offer a chat feature, but it also stole people's Facebook session cookies. A session cookie is the small file that keeps you signed in to a site. With it, criminals took over Facebook accounts. Google removed the extension within about a week, after thousands of people had installed it.

Copycats show up whenever something is popular, like AI chat tools, PDF converters or video downloaders.

You might think good reviews will protect you. They help, but they are not enough:

• Reviews can be fake. Scammers pay for them or write them themselves.
• Old reviews describe the old version. They say nothing about last week's update.
• A high star count can be borrowed from the real tool's popularity.

Before you install, check a few things on the store page:

• Is the name spelled exactly right?
• Does the publisher match the company you expect? A real ChatGPT tool would come from OpenAI.
• Does it link to the maker's official website?
• Do the permissions match the job?

When in doubt, start from the company's own website and follow its link to the store.