Photo by Denny Müller on Unsplash
Most people install a browser extension, forget about it, and trust it indefinitely. That trust is reasonable at the point of install. The problem is what can happen months or even years later, without any warning at all.
Security researchers recently confirmed that a widely used browser extension had been quietly sold to a new owner. The original developer moved on. The new owner pushed an update. That update added malicious functionality. Every user who had the extension installed received it automatically, and most had absolutely no idea anything had changed.
This is not a fringe attack. It is a growing trend, and UK small businesses are squarely in its path.
How a trusted extension becomes a threat
Browser extensions are small software programs that add features to your browser. They can save passwords, block adverts, check grammar, translate pages, or handle dozens of other useful tasks. When you install one from an official store, it goes through a basic review process. At that moment, it is probably fine.
The trouble is that extensions can change ownership. Developers sell their projects. Small companies get acquired. In some cases, attackers specifically seek out popular extensions with large, trusting user bases, purchase them, and then push a malicious update dressed up as a routine upgrade.
Because the extension is already on your device, your browser installs the update silently. You see nothing different on screen. The extension still does what it always did, so nobody notices. Meanwhile, in the background, it may be harvesting your login credentials, reading the content of pages you visit, or redirecting your traffic without your knowledge.
What a rogue extension can actually do
Browser extensions have unusually broad access to your online activity. Depending on the permissions granted when installed, a malicious extension can:
- Read the content of every page you visit, including banking portals and business software
- Capture usernames, passwords, and form data as you type them
- Intercept session cookies, which are the tokens that keep you logged in to sites, allowing an attacker to impersonate you without ever knowing your password
- Inject adverts or redirect you silently to phishing pages
- Monitor internal company tools and cloud applications accessed through a browser
For a small business, the exposure here is often more significant than people realise. If one employee has a rogue extension on the machine they use to access payroll, accounts, or client records, the potential damage runs well beyond that one device.
The fake update scam that travels alongside this threat
Related to the hijacked extension problem is a separate attack that targets employees more directly. Attackers create pop-up messages that mimic genuine browser update prompts. The wording sounds right, the styling looks familiar, and the message creates urgency: your browser is out of date, click here to update now.
Clicking installs malware, not an update.
Real browser updates happen in the background through the browser itself, not through a pop-up on a website you are visiting. If you ever see a prompt on a webpage asking you to download and run an update file, close the tab and update your browser through its own settings menu instead. That one habit alone blocks a meaningful category of attack.
Why small businesses carry more of this risk
Larger organisations often have tools that control which extensions employees can install, and internal teams that monitor for unexpected changes. Most small businesses have neither of those things.
Employees commonly install extensions at will, on work devices, without anyone reviewing what permissions are being granted. An extension installed in good faith two years ago may have changed hands multiple times since. There is no automatic notification when that happens.
The risk compounds further because small business owners tend to handle a broad range of sensitive tasks in a single browser session: banking, HR software, supplier portals, client communications, all in the same window, often on the same device used for everything else.
Practical steps you can take right now
You do not need to become a security expert to reduce this risk in a meaningful way. A few straightforward habits make a genuine difference:
- Audit what is currently installed. Open your browser's extension manager and go through the list. Remove anything you no longer use, do not recognise, or nobody on the team can remember installing.
- Check permissions before installing anything new. Your browser will tell you what an extension wants access to before you confirm. An extension requesting permission to read all data on all websites deserves a second look before you accept.
- Keep the list short. Every extension is a potential attack surface. Fewer installed means fewer opportunities for something to go wrong.
- Stick to well-established sources. Install extensions only from official browser stores, and even then check the developer history, the volume of genuine reviews, and how recently it was updated.
- Treat any on-screen update prompt with suspicion. A pop-up on a webpage asking you to update your browser is almost always a scam. Update browsers through their own menus, not through external prompts.
- Have a brief conversation with your team. If you have employees, they need to know this risk exists. Awareness is genuinely one of the most effective controls available to a small business.
The broader point worth understanding
This type of threat illustrates something important about how modern cyber risk actually works. The danger is not always an obvious attack from outside. Sometimes it is a trusted tool that quietly changed without anyone noticing, sitting on your device with broad permissions, doing exactly what it was always doing plus a great deal more besides.
Staying protected is not only about blocking what you can see coming. It is about maintaining a reasonable level of awareness of what is running on your devices, and keeping that list as lean and as verifiable as possible. If you are not sure where your endpoint risks currently sit, a security review can surface gaps that are genuinely difficult to see from the inside.