Google's Chrome browser is in the spotlight following reports that extensions from its Web Store are being bought from their creators by agencies, pumped full of malware and adware and downloaded onto unsuspecting owners' machines as updated versions.
Extensions - effectively additional pieces of code that can do cool things like scheduling Tweets or consolidating browser tabs - are updated by their respective owners and therefore reside outside of Google's control. That means that even if you've used and trusted an extension since it was first released, the next update could open the door for uninvited spyware to crash the PC party.
As pointed out by Arstechnica, two extensions that Google have removed from the store are Add to Feedly and Tweet this Page. Add to Feedly, built in an hour by creator Amit Agarwai, was purchased for a four-figure sum. When the new owner decided to update the extension, its 30,000 users began to report being redirected to URLs and having adware being injected onto the web pages they viewed.
Not easily removed
Even worse, removing any newly injected malware can be difficult as virus scanners are unlikely to flag JavaScript code as malicious. Google extensions are registered to Google accounts, too, so uninstalling the browser won't remove the threat as signing in will simply download it again.
Google's policies state that ad insertion is allowed as long as the extension clearly discloses these activities to the user. When the extension does not follow this rule, it seems that Google has no way of knowing that the software has started violating this policy. Neither of the affected apps mentioned were removed until Google was notified by The Wall Street Journal.
At this point in time anyone who has ever downloaded an extension is at risk of this happening. Google now knows that this is happening, however, so hopefully the search giant will start to take measures to prevent it from reoccurring soon.
