Security researchers have uncovered a dangerous new method used by malicious browser extensions to steal user credentials by impersonating other legitimate add-ons in real time.
This technique, dubbed a polymorphic extension attack, allows a fake extension to take on the exact appearance and behavior of a real, trusted one, making it incredibly difficult for users to spot the difference.
The attack targets all Chromium-based browsers, including popular choices like Google Chrome, Microsoft Edge, Brave, and Opera.
It’s a stealthy and sophisticated method that can fool even tech-savvy users by exploiting one simple fact, most people trust what they see in their browser’s toolbar.
What Is a Polymorphic Browser Extension?
A Copycat That Disguises Itself as the Real Thing
Polymorphic extensions are browser add-ons that can change their appearance and behavior dynamically, making them hard to detect and block.
In this case, attackers clone another extension’s icon, popup windows, and workflows, making it seem like you’re interacting with the original, when you’re really dealing with a credential-stealing fake.
According to researchers from SquareX, this isn’t just a hypothetical attack. They’ve shown how easy it is to mimic any extension, temporarily disable the real one, and trick the user into entering sensitive data , all while keeping the user completely unaware.
How the Attack Works
Step-by-Step Breakdown of the Polymorphic Trick
- A malicious extension is published on the Chrome Web Store or another extension marketplace. It appears to be a useful utility, like a weather widget or productivity booster.
- Once installed, it performs its promised function to avoid suspicion.
- In the background, it scans for specific extensions installed by the user, using a method called web resource hitting. This checks for assets associated with popular or targeted add-ons.
- If a matching extension is found, the malicious add-on:
- Clones the legitimate extension’s icon and UI
- Disables the original add-on using the browser’s
chrome.managementAPI - Takes its place on the toolbar, looking identical to the one the user trusts
- When the user clicks the cloned icon, they’re asked to log in or re-enter credentials, thinking it’s a routine request from the real tool.
- Credentials are captured and sent to the attacker’s servers, giving them access to emails, cloud accounts, banking portals, or any connected services.
Why This Works: Human Trust in Visual Cues
It Looks the Same, So It Must Be Safe — Right?
This attack takes advantage of something we all do — trusting icons and layout cues. When you see your favorite password manager’s icon or your go-to productivity extension, you naturally assume it’s safe.
“The power of this attack lies in how visually seamless it is,” said researchers at SquareX. “Users think they’re using the same tool they’ve always used — but it’s just a well-disguised impostor.”
Even if the browser’s functionality hasn’t changed, the temporary disabling of the original extension hides any hints that something might be wrong.
Chromium Browsers Are All at Risk
Chrome, Edge, Brave, and Others Share the Same Vulnerability
This polymorphic attack doesn’t rely on a browser flaw — it abuses legitimate browser features in Chromium-based browsers, like:
- Chrome
- Microsoft Edge
- Brave
- Opera
The use of APIs like chrome.management is allowed under current permissions, and many extensions legitimately access it to manage themselves. That’s what makes this attack so hard to block — it’s technically “allowed” behavior, just used in a deceptive way.
Google’s Response to the Threat
No Immediate Fix — But Promises of Action
Google acknowledged the findings and confirmed it had received the report.
“We appreciate the work of the research community and we’ve received the report,” a spokesperson said. “We are constantly investing in ways to improve the security of the Chrome Web Store.”
That said, no specific fix has been announced yet, and the attack vector remains available to those willing to abuse the extension system.
A Follow-up to Browser Syncjacking
Part of a Bigger Trend in Extension Abuse
This isn’t the first time browser extensions have been shown to pose a serious risk. Just a month ago, Google disclosed Browser Syncjacking — another attack method where a rogue extension could sync malicious settings and data across multiple devices, using the user’s own account.
Both these methods point to a larger issue: browser extensions are still a huge blind spot in most security setups.
How to Protect Yourself from Polymorphic Extension Attacks
Best Practices for Users and Security Teams
While there’s no surefire patch right now, you can lower your risk with these steps:
- Install extensions only from trusted developers
- Review extension permissions carefully — be wary of add-ons that ask to manage other extensions
- Limit the number of extensions you use — fewer tools mean fewer potential entry points
- Monitor for changes in behavior — if an extension you use suddenly asks for credentials, think twice
- Use a reputable browser security extension that tracks permission changes or extension activity
- IT teams should disable the
chrome.managementAPI via group policy or enterprise tools if it’s not needed
FAQs
What is a polymorphic browser extension attack?
It’s a type of attack where a malicious extension changes its icon and behavior to impersonate another, trusted extension, fooling users into sharing credentials.
How does the extension disable the original one?
Using the chrome.management API, the fake extension can disable others, making it the only visible version on the browser toolbar.
Which browsers are affected?
Any browser built on Chromium, including Google Chrome, Microsoft Edge, Brave, and Opera.
How can I tell if an extension is fake?
It’s hard. Look for sudden behavior changes, new login prompts, or missing features. Always double-check the extension’s developer and permissions.
Has Google fixed this issue?
Not yet. Google is aware of the issue and has promised continued investment in Chrome Web Store security but hasn’t issued a specific fix.
Is this the same as browser hijacking?
Not exactly. While both involve manipulation of browser behavior, polymorphic attacks focus on disguising malware as something familiar.
