Browser-Extension on CuraSec

Chrome/Edge extensions caught stealing crypto and browser data

Sun, 30 Aug 2026 15:19:58 +0000

Engineer — Plan: Audit installed Chrome/Edge extensions across your managed fleet and enforce an allowlist policy; no CISA KEV or active enterprise exploitation signal, but browser extension supply-chain risk is real for developer workstations.
SOC/IR — Act: Hunt for suspicious extension IDs from the reported malicious set in browser inventory logs and EDR telemetry; also look for ClickFix lure behavior (fake captcha/update prompts triggering clipboard/PowerShell execution) as a detection pattern since this reporting date.
Leader — Plan: Browser extension governance is a gap in most enterprise policies — use this as a prompt to task the team with drafting an approved-extension policy before the next audit cycle.

Thu, 23 Jul 2026 12:47:45 +0000

Engineer — Plan: Audit enterprise Chrome extension policies to confirm the Adobe Acrobat extension is at current patched version; consider restricting extension permissions via managed browser policy if update cadence is slow.
SOC/IR — Learn: No active exploitation or IOCs reported; file as a reference for understanding cross-origin data leakage via browser extension privilege abuse if hunting similar patterns later.
Leader — Skip

Thu, 23 Jul 2026 12:47:45 +0000

Engineer — Plan: The patched Adobe Acrobat Chrome extension (CVE-2026-48294) could allow malicious sites to silently read WhatsApp Web session data; public PoC exists but EPSS is 0.01 and KEV-unlisted. Audit enterprise browser policies and confirm the extension has been updated to the patched version across managed endpoints.
SOC/IR — Learn: No active exploitation campaign or IOCs published; the HermeticReader attack chain demonstrates how a privileged browser extension can be abused to silently cross-read web app data — useful context for evaluating browser extension detection coverage but no immediate hunt or rule-write warranted.
Leader — Skip
Signals: CVE-2026-48294 — CISA KEV: not listed, EPSS 0.01, public PoC on GitHub

Fri, 17 Jul 2026 12:06:10 +0000

Engineer — Plan: If your org uses the Claude Chrome extension with connected services (Gmail, Docs, Salesforce), audit which extensions are installed alongside it and restrict extension installs via policy; monitor for an Anthropic patch and deploy it when released.
SOC/IR — Learn: No active exploitation or IOCs reported; the attack chain (malicious extension simulating clicks to abuse AI-connected services) is worth understanding as a new browser-based lateral movement pattern for future detection design.
Leader — Learn: Illustrates supply-chain risk of AI browser integrations accessing business-critical SaaS; worth flagging to the team reviewing AI tool policies but no immediate board-level action needed absent active exploitation.

Wed, 15 Jul 2026 12:11:39 +0000

Engineer — Plan: If Claude for Chrome is deployed in your environment, audit which other extensions have scripting access to claude.ai and consider disabling the integration until Anthropic ships a complete fix; Anthropic’s May patch only narrowed the arbitrary-prompt path, not the cross-extension trigger surface.
SOC/IR — Learn: The attack chain (rogue extension injecting scripts on claude.ai to pivot into Gmail/Docs/Calendar) represents a new cross-extension privilege escalation pattern via AI browser tools; no active exploitation or IOCs reported, so no hunt to run today, but worth modeling for detection of unauthorized extension installs.
Leader — Plan: If Claude for Chrome is in your approved-tools list, confirm with your IT/security team whether employees are running it and assess exposure to sensitive data in Gmail, Docs, and Calendar; request Anthropic’s remediation timeline before the next quarterly tool review.

Tue, 14 Jul 2026 12:08:08 +0000

Engineer — Act: ModHeader is widely used by engineers for API and header debugging — remove it from all developer and CI browsers now and replace with a vetted alternative; dormant or not, undisclosed collection code in a tool with store-level trust is a supply-chain red flag.
SOC/IR — Plan: No active exploitation or IOCs to sweep for, but this is a prompt to audit the browser extension inventory across developer workstations and establish an approved-extension policy or detection for unapproved extension installs.
Leader — Learn: No data was collected and both stores have already pulled the extension, so no breach disclosure or vendor inquiry is warranted; useful data point on browser-extension supply-chain risk when building or updating software-inventory and vendor-vetting policies.