Tootfinder

It's not Easy: Applying Supervised Machine Learning to Detect Malicious Extensions in the Chrome Web Store
Ben Rosenzweig, Valentino Dalla Valle, Giovanni Apruzzese, Aurore Fass
https://arxiv.org/abs/2509.21590

It's not Easy: Applying Supervised Machine Learning to Detect Malicious Extensions in the Chrome Web Store
Google Chrome is the most popular Web browser. Users can customize it with extensions that enhance their browsing experience. The most well-known marketplace of such extensions is the Chrome Web Store (CWS). Developers can upload their extensions on the CWS, but such extensions are made available to users only after a vetting process carried out by Google itself. Unfortunately, some malicious extensions bypass such checks, putting the security and privacy of downstream browser extension users a…

Passwords and FIDO2 Are Meant To Be Secret: A Practical Secure Authentication Channel for Web Browsers
Anuj Gautam, Tarun Yadav, Garrett Smith, Kent Seamons, Scott Ruoti
https://arxiv.org/abs/2509.02289

Passwords and FIDO2 Are Meant To Be Secret: A Practical Secure Authentication Channel for Web Browsers
Password managers provide significant security benefits to users. However, malicious client-side scripts and browser extensions can steal passwords after the manager has autofilled them into the web page. In this paper, we extend prior work by Stock and Johns, showing how password autofill can be hardened to prevent these local attacks. We implement our design in the Firefox browser and conduct experiments demonstrating that our defense successfully protects passwords from XSS attacks and malic…

If you're using Chrome, don't use VPN extensions like FreeVPN.One unless you don't mind it taking screenshots of every website you visit. (Use VPNs like Mullvad or Proton)
https://cyberinsider.com/chrome-vpn-extension-with-100k-i…

Chrome VPN Extension With 100k Installs Screenshots All Sites Users Visit
FreeVPN.One, a verified Chrome extension with over 100k installs on the Chrome Web Store, is taking screenshots of sites users visit.