![\"Google](\"https:\/\/www.newsbeep.com\/ca\/wp-content\/uploads\/2025\/07\/1753852988_936_960x0.jpg\")
<\/p>\n<\/p>\n
Be careful what you install.<\/p>\n
dpa\/picture alliance via Getty Images<\/p>\n
Google has issued an urgent warning for 2 billion Chrome users. A high-severity memory vulnerability could enable attackers to target users through the websites they visit. This has been fixed and all users should update and restart<\/a> now.<\/p>\n CVE-2025-8292<\/a> is a critical fix, but there\u2019s a much more dangerous threat to Chrome users that is hidden from sight. And so while all desktop users must ensure they move to version 138.0.7204.183\/.184 of the browser, that\u2019s not enough to stay safe.<\/p>\n This threat that should worry you more comes from extensions that might appear to be officially verified, but which have been designed or hijacked to attack your device.<\/p>\n ForbesWhy You Should Delete All Passwords Saved In Google ChromeBy Zak Doffman<\/a><\/p>\n \u201cMillions of users have their data stolen,\u201d SquareX\u2019s Vivek Ramachandran told me, as the extension-focused security team released its latest threat report<\/a>. The alarming reality, he says, is that security tools do not have \u201cvisibility into the dynamic behavior of extensions at run time to protect users against the rising threat vector\u201d<\/p>\n The past few years, SquareX says, \u201chave witnessed a surge in malicious browser extensions, including the Geco Colorpick, Cyberhaven and the Great Suspender. These malicious extensions exfiltrate data, steal session cookies, spread spyware and even hijack browser sessions of victims.\u201d<\/p>\n This includes extensions that were dangerous from the get-go, but also \u201cbenign extensions that turned malicious \u2014 either due to a compromise or change in ownership \u2014 exploiting trusted extensions with a wide existing installed base.\u201d<\/p>\n \u201cMost enterprises still rely on extension store labels like \u2018Verified\u2019 and \u2018Chrome Featured\u2019 to determine its security,\u201d Ramachandran says. \u201cThis research showed that this is approach is extremely flawed as it turns out browser vendors and enterprises do not have sufficient tools to conduct extension analysis.\u201d<\/p>\n This latest extension warning from SquareX echoes prior reports that focus on the hidden threats from extensions now installed by most users without any of the checks and balances applied to the browser itself. In a world of increasing AI threats, including the use of marauding browser AI agents,<\/a> this is a huge risk.<\/p>\n \u201cThe majority of extensions today are downloaded and installed from official stores like Chrome Store,\u201d SquareX says. But store badges \u201ccan be easily gamified by attackers with fake reviews and mass downloads. As a result, numerous Verified and Chrome Featured Extensions have been discovered as malicious, including the latest disclosure<\/a>.\u201d<\/p>\n