Threat researchers at McAfee Labs have discovered 5 malicious extensions for Google Chrome, that track the browsing activity of the user, with a total of 1.4 million users affected. The identified extensions are: Netflix Party, Netflix Party 2, Full Page Screenshot Capture – Screenshotting, FlipShope – Price Tracker Extension, and AutoBuy Flash Sales. Although these extensions do perform the functionality that they advertise, such as website coupons, screenshotting, and allowing users to watch Netflix together, they also perform cookie stuffing on eCommerce websites visited by the users.  

The web app manifest file, manifest.json, sets the background page to be bg.html. This HTML file in turn loads a script bo.js, which is multifunctional. One of the actions of this script is to send the URL that the user is visiting to the malicious actor’s server. This is triggered by an event coming from chrome.tabs.onUpdated which occurs when a user accesses a new URL within a tab. After the URL is harvested, it is checked against a list of known websites, and then return either a response ‘c’ or ‘e’. If the response is ‘e’, the extension will insert the response as a cookie into the website. If the response was ‘c’, the extension instead inserts the URL as an Iframe to the site being visited. The extension owner’s affiliate ID is now associated with the user’s visit to the site. Any time the user makes a purchase on this site, the extension owners will now receive a commission.  

 Although some of these malicious extensions appear to have been removed from the Chrome Web Store, “Full Page Screenshot Capture – Screenshotting” and “FlipShope – Price Tracker Extension” are still available to download at the time of writing. When extensions are removed from the store, they are not automatically deleted from the browser they are installed on. Users need to manually uninstall these extensions by opening the menu to the right of the user profile list, which is located at the top right of the browser window. In this drop-down menu, select More Tools, and then click on Extensions. You can then delete any currently installed extensions from the browser by clicking Remove on each one.