Chrome Has a Malware Problem, and Google Needs to Fix It

[UPDATED Oct. 2, 2018 with new changes to how Google handles the development and implementation of Chrome extensions. This story was originally published on Nov. 7, 2017.]

Google's Chrome browser has been praised for continuously upgrading its own security. Chrome OS, which is based on the browser, is one of the safest operating systems in widespread use. So, then, why is Google doing such a poor job of screening Chrome extensions?

We assume all these extensions are safe. Credit: Mark Spoonauer/Tom's Guide

(Image credit: We assume all these extensions are safe. Credit: Mark Spoonauer/Tom's Guide)

At least half a dozen malicious Chrome extensions have been discovered in the past few months, most coming from the official Chrome Web Store. 

Some loaded adware and took users to sleazy websites. Others stole personal data or used victims' computers to "mine" cryptocurrencies. Somehow, they all got through Google's mostly automated screening process, and in most cases, even the best antivirus software won't be able to stop them.

If Google lets this continue, the Chrome Web Store, and Chrome in general, could end up as riddled with malware as Android, whose Google Play marketplace also has an automated app-screening process of questionable efficiency. And if the Chrome browser falls, then so does Chrome OS, which millions of schoolkids use on their Chromebooks. Google needs to fix this problem now.

'A joke' and 'a wreck'

"The current malware detection on the Chrome Web Store is a joke," wrote Danish computer-science student Maxime Kjaer in a recent blog post. "Currently, all it takes to get around it is to download the payload on installation rather than shipping with it. This has been the case for years now, and it doesn't seem like Google is doing much about it."

Kjaer was writing about a Chrome extension that pretended to verify the user's age so he or she could view porn, but actually stole authentication tokens for social-media sites. If you log into Facebook with that malicious extension loaded, it can steal your Facebook token and take over your Facebook page.

This past week, Lawrence Abrams at Bleeping Computer wrote about an image-downloading Chrome extension that loaded adware into the browser and took users to various sleazy websites.

Abrams reported the extension to the Chrome developers, but on Friday afternoon, Nov. 3, two days after Abrams published his piece, the extension was still in the Chrome Webstore. (It's since been taken down.)

"It is starting to become more and more common for unwanted and malicious extensions to be uploaded to the store and not be removed for quite a while," Abrams noted.

On in late September, Martin Brinkmann was more blunt as he wrote about a Chrome extension that supposedly made your browsing safer from malware, but in fact secretly ran a cryptocurrency miner.

"Google's automatic verification system for Chrome extension uploads to the official Chrome Web Store is a wreck," Brinkmann wrote.

A URL-shortening Chrome extension also ran a cryptocurrency miner, software engineer Alessandro Polidori noted in a Medium posting Oct. 14, adding that "the spread of malware through Chrome extensions seems to be an increasingly widespread problem."

On the blog of the SANS Internet Storm Center on Oct. 27, Brazilian security researcher Renato Marinho detailed how a fake WhatsApp installer quite brazenly installed a Chrome extension that stole data that a user entered into online form fields.

The extension was not in the Chrome Web Store, but the malware easily disabled Chrome's restrictions so that non-Web Store software could be installed.

Google knows, but is that enough?

We contacted Google about this recurring problem, and a Google spokeswoman pointed us to a recent posting on the official Chromium developer blog regarding a phony AdBlock Plus extension. (Chromium is the open-source browser underpinning Chrome, and most Chrome software development actually takes place in Chromium.)

"We [want] to acknowledge that we know the issue spans beyond this single app," the posting said. "We can't go into details publicly about solutions we are currently considering (so as to not expose information that could be used by attackers to evade our abuse fighting methodologies), but we wanted to let the community know that we are working on it, as we continually strive to improve our protection and keep users safe from malicious Chrome Extensions and Apps."

It's nice that Google is aware there's a problem with Chrome Web Store malware, but it's been aware of the problem for at least 5 years. The Google spokeswoman also directed us to an academic paper published by Google researchers in mid-2015 entitled "Trends and Lessons from Three Years Fighting Malicious Extensions."

In the paper, the researchers say they had removed 9,523 malicious extensions from the Chrome Web Store from 2012 to 2015. That's admirable, but those extensions should never have made it into the store in the first place.

Is it impossible to keep malware out of an app store or an extension store? Perhaps, but Apple has come close to pulling it off — the number of known incidents involving malicious apps found in the iOS App Store over the past decade has not yet reached double digits.

How to fix this (hint – it costs money)

There is a simple way to solve this problem, but it's slow and expensive. Google needs to have humans manually run and review every single Chrome Web Store extension, rather than have machines sort out the bad-looking ones, let the rest go live and rely on bad user reviews to flag any further problems. Human app review is what Mozilla does with Firefox's extension repository, and what Apple does with iOS apps.

Implementing human review of every extension might greatly reduce the number of extensions that get approved every day for the Chrome Web Store. It might make some developers grumble. It will cost Google a lot to hire more extension testers. But the alternative is to let the Chrome malware problem get worse — and to threaten the market shares of Chrome and Chrome OS, and the security of millions of users.

"Fix the Chrome Webstore," Kjaer wrote. "It's one of the largest single security threats to the web right now."

UPDATE: Even as the abuse of Chrome extensions continues, Google is finally doing something about this problem. In the summer of 2018, it began to forbid "in-line" links that installed Chrome extensions immediately; those links now have to go to the extension's Chrome Web Store page so the user can learn more about it first.

On Oct. 2, 2018, Google announced several new restrictions on Chrome extensions.

— "Obfuscated" code, i.e. code that's deliberately hard for humans to read, is banned immediately.

— An extension's permissions will be limited to those necessary for its stated purposes.

— Later in October with Chrome 70, users will be able to limit an extension's abilities to specific websites rather than all websites.

— All Chrome extension developers will be required to implement two-factor authentication on their Google developer accounts to prevent unauthorized changes.

We don't know how much of an effect these restrictions will have on malicious extensions, but the Chromium blog post noted that 70 percent of malicious or ethically dubious extensions used obfuscated code. We'd still prefer to see humans checking each new Chrome extension before it's pushed out into the wild.

Best Antivirus Software

Paul Wagenseil

Paul Wagenseil is a senior editor at Tom's Guide focused on security and privacy. He has also been a dishwasher, fry cook, long-haul driver, code monkey and video editor. He's been rooting around in the information-security space for more than 15 years at, SecurityNewsDaily, TechNewsDaily and Tom's Guide, has presented talks at the ShmooCon, DerbyCon and BSides Las Vegas hacker conferences, shown up in random TV news spots and even moderated a panel discussion at the CEDIA home-technology conference. You can follow his rants on Twitter at @snd_wagenseil.

  • elfhaven13
    Thank you so much. What's really irritating is for computer illiterate people like me. I'm depending on the large corporation to do its job and when you think you are using the best it's not reassuring when the best can't seem to do the right thing. It costs money? Of course it does. When Google has the biggest part of the pie so to speak, they gave the money.
    Can you tell us about Puffin? I would appreciate the particulars of that one and your thoughts good bad or ugly.
  • mike.kane4545
    One extension that has caused me trouble is Xmarks for bookmarks, I ended up moving to Bookmark OS
  • mdwh
    It's nonsense to suggest a person can manually do better than automated checking - by that logic, we should do away with virus checkers. It would be trivial to obscure malicious behaviour from someone reviewing it (e.g., activate after a set date or time, or based on IP address).

    People don't target ios the same reason they don't target Windows Phone - hackers go for popular platforms, Windows and Android, not the three people still using an apple phone. For browsers, that's Chrome.
  • Paul NZ
    Chrome the browser is a malware / crash magnet.

    Most of the people I know have nothing but probs using it. It either crashes, or somehow their system ends up getting infected after using it
  • SumTingW0ng
    This is why we shouldn't trust AI at all! AI is dangerous and us security experts are making the wrong choice for it.
  • jpmonteith
    Google should definitely work to eliminate bad extensions. Google could simply have a flag on extensions for those that have been reviewed so that the end user knows they are taking a chance if they install it.

    However, we should avoid overstating the problem. One example in this article is saying that kids in school would be infected. They wouldn't. The school district controls the extensions available on the systems and students cannot just install whichever ones they want.

    Also, we should realistically take into account that, while it is bad - it is nowhere near the same level as getting a virus on a Windows machine that can destroy the system / data or hold your information for ransom. The problem is also tiny by comparison. Where one third of all Windows machines are believed to be infected (millions and millions of machines), the numbers here are minuscule by comparison.

    That said - Google definitely needs to step up their game, if for no other reason than their reputation of keeping Chrome users safe.
  • mystilleef
    "Is it impossible to keep malware out of an app store or an extension store? Perhaps, but Apple has come close to pulling it off — the number of known incidents involving malicious apps found in the iOS App Store over the past decade has not yet reached double digits."

    That's BS.

    And that's not even a complete list.

    Apple forbids and even legally threatens Security researchers from publicly disclosing what they consider to be harmful security exploits.

    Not to mention, 9 out of 10 smartphones used globally are Android phones. It goes without saying, therefore, that 9 out 10 malicious software targets Android.

    What's even more impressive that even though 99% of malware targets Android less than 1% successfully evades Androids built-in security.

    So your theory that Android is riddled with malware is backed up by old wives tales. It is objectively and factually false. But I understand you have a narrative to follow and clicks to earn.
  • rosa.alan
    Well said MYSTILLEEF! I couldn't agree more.
  • xrayangiodoc
    More specificity as far as which extensions are at issue would have been helpful!