Google removes 34 malicious Chrome extensions from Web Store

Google has removed 34 malicious Google Chrome extensions from Chrome Web Store. These malicious extensions have collective downloads of over 87 million. After the installation, these extensions offer a legitimate function but later show malicious behaviors such as altering search results and showing spam or unwanted ads.

Researcher Wladimir Palant initially analyzed the PDF Toolbox extension and published a detailed report on May 16. The Chrome extension was available in Chrome Web Store and had 2 million downloads. He found the malicious code disguised as a legitimate extension API wrapper. This malicious code was allowing serasearchtop[.]com to inject arbitrary JavaScript code into any website the user visits on the browser. The injected code inserts ads into web pages. But, 24 hours after installing the extension, the extension also shows malicious intentions.

Later on May 31, Palant wrote another article after he found the same malicious code in other extensions available on the Chrome Web Store. He found a few extensions with the same behavior in the next two days. When he last updated the article, he found 34 malicious extensions with collective downloads of 87 million users.

Here’s a list of all the malicious extensions Palant found. Most of these extensions now have been removed from Chrome Web Store. Hopefully, the Remaining extensions will also be removed from the Web Store soon.

Look at the list carefully, these malicious extensions are actually useful. That’s the reason they also have a good number of downloads.

If you have any of these extensions installed on your browser, you need to remove them right now.