Researchers show how browser extensions can abuse Claude Dispatch to approve prompts and execute code through Claude Desktop.

Browser extension permissions are manifest-declared grants deciding which sites, tabs, cookies and network traffic a Chrome, Firefox or Safari add-on can reach.

Browser extension permissions are manifest-declared grants deciding which sites, tabs, cookies and network traffic a Chrome, Firefox or Safari add-on can reach.

At a Glance Malware family Fake wallet extensions in two families: Rabby clones and OKX clones Threat actor Unnamed; linked with high confidence to an August 2026 Socket campaign Targets Firefox users importing crypto wallets; victim counts not disclosed Delivery vector Malicious listings on Mozilla's Firefox add-ons store Key capabilities

În ultimii ani, bannerele de cookie-uri au devenit o parte inevitabilă a experienței online. De multe ori sunt intenționat confuze, încărcate cu opțiuni

A Harmless Timer With a Hidden Job The most innocent timer in Chrome could do very different work. Meanwhile, the user saw only a familiar start button. The Spur team discovered that the Mellowtel SDK, embedded in browser extensions, turned home connections into nodes of a distributed network. That network loaded websites and passed their content to remote infrastructure. How the Mellowtel SDK Works…

Install the SpinWheelPlus extension for Chrome, Edge, or Firefox. Android and iOS are not listed yet. The full editor stays in your browser.

Page Rage is a free game that lets you destroy any page. Dealing with things in a healthy way is overrated. Hide from your problems and break things instead!

A new malware can install browser extensions without your permission or knowledge, and then do quite a lot of damage.

Google has deleted all remaining Manifest V2 extensions from the Chrome Web Store, ending updates and new installs for legacy extensions.

At a Glance Malware family Offside Wallet Theft Factory (campaign of cloned wallet-stealing extensions) Threat actor Unattributed; a common publishing pipeline or closely related actors (under investigation) Targets Firefox users of Web3 and crypto wallets (OKX, Rabby, TronLink and others) Delivery vector Malicious Firefox Add-ons impersonating wallets and disguised utilities Capabilities

Researchers built a proof-of-concept extension designed to steal passwords, submitted it to the Chrome Web Store, and watched it clear review. That's not the only gap they found.

A CLI tool "rolodex" that generates CSS for browser extensions to highlight Reddit friends has been released. It enables implementation on sites like Tildes and Lobsters.