Chrome, Edge, Firefox Warning—99% Of Browsers Now At Risk

Forbes

15-04-2025

Why you need to change your browser
getty
Sometimes the most dangerous risks are those we think least about, lurking behind the scenes in the apps and platforms we use daily. While the malware attacking our phones generates headlines, that's rarely the case with the permission abuse that affects most users, almost all of the time. And while secretive tracking and malware attacks on our browsers prompt update warnings and settings changes, that's still not true with a threat that's just as pervasive and is now a major threat to users worldwide.
We're talking extensions, which have finally come into view in the last year as popular add-ons are hijacked to threaten those using them. And while Google is fighting back, it's clear that this attack surface remains wide open to exploit. That's certainly the new warning from the security research team at LayerX, which is in the business of securing enterprises from extension exposure.
The team warns that 'most users don't realize that browser extensions are routinely granted extensive access permissions that can lead to severe data exposure should those permissions fall into the wrong hands.' And when those extensions are trivial, just as with mobile apps, that's an easy trojan horse into an enterprise. 'Users often use such extensions to fix their spelling, find discount coupons, or other productivity uses… This is particularly a risk to organizations since many organizations do not control what browser extensions users install on their endpoints.'
This follows a similar warning from CrowdStrike a few weeks ago. 'While it's common for users to install browser extensions to tailor their online experience to better meet their needs and preferences, these tools also carry significant security risks. Browser extensions are yet another avenue that can be exploited by cyber attackers or act as a vehicle for malware.' Which means that 'to reduce the attack surface and limit potential vulnerabilities, users should install only essential browser extensions.'
There are frequent warnings that connecting your own phone to your employer's networks and systems exposes the company to your own security weakness. The same is true of extensions. 'A compromised browser extension of an individual user can lead to exposure and breach of the organization as a whole.'
Most people reading this will give little if any thought to extensions. But given the stark numbers in the research, you probably should. '99% of enterprise users have a browser extension installed in their browsers, and more than half (52%) of employees have more than 10 extensions installed.' And while official Chrome, Edge and Firefox stores are the 'most common source,' the threat 'is much wider than most users realize.'
The numbers are frightening.
LayerX
Not to state the obvious, but this means that almost every organization is exposed, relying on corporate IT defenses to ensure endpoint integrity across all those users. Unless their desktops are completely locked down, which doesn't happen often.
LayerX reports that '53% of enterprise users have installed a browser extension with 'high' or 'critical' risk scope, meaning that such extensions have access to sensitive data such as cookies, passwords, web page contents, browsing information, and more, putting users at risk of credential theft or data exposure.'
And again, just as with mobile apps the red flags are all in plain sight. More than half of extension publishers hide behind little more than a free Gmail account, more than three-quarters have a single extension under their name, and most don't even have a privacy policy to review.
While other browsers are vulnerable to extension abuse, this is really all about Chrome which dominates the install base. 'Securing Chrome browsers should be an organizational security team's #1 priority,' LayerX says.
This is such a fragmented market that it's little surprise to read these findings. The vast majority (95%) of Chrome extensions 'have fewer than 10,000 installs' and only 0.2% have 'more than one million users.' There is not the same level of awareness and user savvy we see on mobile phones and apps, which are still highly vulnerable.
As Bleeping Computer warned earlier this year, the recent exposure of cybercriminals hijacking extensions 'sheds a spotlight on the identity risks posed by browser extensions, and the lack of awareness that many organizations have about this risk.'
The one key recommendation is that enterprises need a better sense of their risk. And that means auditing or shutting down their extensions in use. And home users should limit extensions to those they need and can categorically trust.
'Many organizations don't have a full picture of all extensions that are installed in their environment,' LayerX says. 'Many organizations allow their users to use whichever browsers (or browsers) they wish to use and install whatever extensions they want. However, without a full picture of all extensions on all browsers of all users, it is impossible to understand your organization's threat surface.'