Unfortunately, if you want to see if any of the extensions you've added to Chrome are on this list, you've got to do so manually. It doesn't make for interesting reading, but here's the full list of the extension IDs of all 111 malicious Chrome (and Chromium) extensions that Awake discovered. (You can enable it when you need it.) Doing so will make Chrome run faster and free up memory on your computer. Remember, if you have a Chrome browser extension installed, but you don't need it at the moment, you can always go to chrome://extensions/ to disable it without removing it. “Just like downloading anything to your device, I would always advise caution with add-ons as Google cannot verify each extension independently.” 'It's vital to check which permissions a browser extension requires especially when it’s free as some can be harmful,' he said. “Illicit extensions usually require permissions to grant further access to data on your machine which users must be vigilant of,' Jake Moore, a security specialist at ESET, told Tom's Guide. A spokesman for the tech giant, Scott Westover, told Reuters: “When we are alerted of extensions in the Web Store that violate our policies, we take action and use those incidents as training material to improve our automated and manual analyses.”

Taking actionĪfter learning of the malicious extensions last month, Google removed 79 of them.

The researchers aren’t sure who is behind the attack, but told Reuters that the attackers used fake contact details when applying to have their extensions published on the Chrome Web Store. However, the Awake report said that nearly 60% of the GalComm-registered domains that Awake researchers could reach were 'malicious or suspicious.' It added that 'GalComm is at best complicit in malicious activity.'Īwake co-founder and chief scientist Gary Golomb suggested that this was the most far-reaching malicious campaign found on the Google Chrome Store. GalComm's owner told Reuters that his company was not aware that it was being used as part of a malicious campaign. The firm also found that the attackers used an infrastructure of 15,160 malicious or suspicious domains and were able to bypass sandboxes, endpoint detection and response solutions and web proxies.Ĭybercriminals bought the domain names from GalComm, an Israel-based domain registrar.

How to see all google chrome extensions