<h1>Discovery of Chrome Extensions Exposing User Browsing History</h1>
A significant privacy concern has been uncovered by a security researcher known as ‘Q Continuum,’ who identified 287 Chrome extensions responsible for exfiltrating users’ browsing histories to external servers. With a collective user base of approximately 37 million, these extensions fall into various categories, such as VPNs, coupon finders, PDF tools, and ad blockers. Notable extensions involved include Stylish, BlockSite, SimilarWeb, and WOT.
Using an automated pipeline that ran Chrome within Docker containers, complemented by MITM proxies, the researcher tracked and analyzed the network traffic. This allowed for the detection of history leakages by matching outbound network requests with visited URLs. Many extensions were found to request broad host permissions, enabling them to monitor user navigation across domains effectively.
The exfiltrated data, often concealed using complex obfuscation and encryption techniques like Base64, ROT47, LZ-String compression, or AES-256 encryption with RSA-OAEP, made automated detection challenging. Once decrypted, the payloads exposed raw Google search URLs, referrers, user IDs, and timestamps that were sent to various proprietary domains.
The entities behind these data leaks include companies like Similarweb, Semrush, Alibaba, and ByteDance, as well as smaller data brokers and some unknown operators. Although some extensions disclose data collection within their privacy policies, users are frequently unaware that they have consented to the sale of their browsing data.
This discovery underscores ongoing privacy concerns surrounding browser extensions, even in light of Google’s Limited Use policy. While not all extensions flagged may have malicious intent—some genuinely require browsing data to function—this research sheds light on the potential risks users face when installing these extensions.

Collections

A security researcher identified 287 Chrome extensions collectively installed by ~37 million users that silently exfiltrate browsing histories to external servers. The extensions span categories like VPNs, ad blockers, PDF tools, and coupon finders — including well-known names like Stylish, BlockSite, SimilarWeb, and WOT. The researcher used an automated pipeline with Chrome in Docker containers and MITM proxies to detect history leakage by matching outbound requests to visited URLs. Exfiltrated data was often obfuscated using Base64, ROT47, LZ-String, or AES-256/RSA-OAEP encryption, making detection difficult. Once decrypted, payloads revealed raw search URLs, referrers, user IDs, and timestamps sent to domains tied to companies like Similarweb, Semrush, Alibaba, and ByteDance. While some extensions disclose data collection in privacy policies, most users remain unaware their browsing data is being sold.

Security Concerns Arise with 287 Chrome Extensions Leaking Data

😄 Will LibreWolf installs spike?