Google Chrome is the world’s most popular internet browser so it is no surprise that its extensions are also used far and wide. Browser extensions bring convenient features such as blocking ads, taking quick screenshots, finding coupons on shopping websites, and more.
Unfortunately, some highly popular Chrome extensions are stealing your personal data according to a new report from McAfee. These extensions include Netflix Party, Netflix Party 2, Full Page Screenshot Capture, FlipShope, and more. These have over 1.4 million downloads altogether.
Read also: Fintech sector’s growth shaping Pakistan’s future
Out of all these extensions, Netflix Party and Netflix Party 2 are the most popular ones with over 800,000 and 300,000 downloads respectively. As the name says, this extension lets you watch Netflix together with friends and family online by syncing videos. It also gives you a chat room next to your Netflix content and the ability to pause and play your videos for everyone in the party.
FlipShope tracks prices across different shopping websites and Full Page Screenshot Capture needs no explanation.
How They Did It
According to McAfee’s report, these extensions can load a multipurpose script that transfers browsing data to an attacker-controlled domain. Every time you visit a new website, the data is transferred to this domain. The extensions were reportedly stealing user ID, device location, zip codes, nationality, and more.
The move was used to insert code into eCommerce websites that the victims were visiting. The code was modifying cookies from these websites to receive affiliate payments for any products purchased.
McAfee was quick to inform Google about their findings and the Chrome Web Store has now removed Netflix Party, Netflix Party 2, and Auto Buy Flash Sales.
FlipShope and Full Page Screenshot Capture, on the other hand, are still available for download at the store and it is unclear why.
