{"id":202435,"date":"2022-08-31T11:25:16","date_gmt":"2022-08-31T09:25:16","guid":{"rendered":"http:\/\/sftarticles.wpenginepowered.com\/en\/?p=202435"},"modified":"2025-07-01T20:29:18","modified_gmt":"2025-07-02T03:29:18","slug":"chrome-extensions-stealing-your-data","status":"publish","type":"post","link":"https:\/\/cms-articles.softonic.io\/en\/chrome-extensions-stealing-your-data\/","title":{"rendered":"These Chrome extensions with over 1 million downloads are stealing your data"},"content":{"rendered":"\n<p>Chrome extensions add utility to an already extremely useful Google Chrome browser. Unfortunately, however, just like with any other sort of downloadable app or file we need to be careful when installing them onto our devices. We recently covered a fake Chrome extension that was masquerading as the plugin for a popular Windows app. Today, however, we <strong>bring you news of several extensions that are secretly tracking their users\u2019 browser activity<\/strong>.<\/p>\n\n\n<div class=\"sc-card-program\">\r\n  <div class=\"sc-card-program__body\">\r\n    <div class=\"sc-card-program__row clearfix\">\r\n      <div class=\"sc-card-program__col-logo\">\r\n        <img decoding=\"async\" class=\"sc-card-program__img\" alt=\"Google Chrome\" src=\"https:\/\/images.sftcdn.net\/images\/t_app-logo-xl,f_auto\/p\/b2e6d43a-96bf-11e6-a674-00163ed833e7\/965337810\/chrome-Google_Chrome_logo.png\" width=\"100px\" height=\"100px\">\r\n      <\/div>\r\n      <div class=\"sc-card-program__col-title\">\r\n        <span class=\"sc-card-program__title\">Google Chrome<\/span>\r\n        <a class=\"sc-card-program__button sc-card-program-internal\" href=\"https:\/\/chrome.en.softonic.com\/\" target=\"_self\" rel=\"noopener noreferrer\">Download Now<\/a>\r\n      <\/div>\r\n      <div class=\"sc-card-program__col-rating\">\r\n        <svg class=\"rating-score__content\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" version=\"1.1\" x=\"0\" y=\"0\" viewbox=\"0 0 50 50\" enable-background=\"new 0 0 50 50\" xml:space=\"preserve\"><path class=\"rating-score__background rating-score--good\" fill=\"none\" stroke-width=\"6\" stroke-miterlimit=\"10\" d=\"M40 40c8.3-8.3 8.3-21.7 0-30s-21.7-8.3-30 0 -8.3 21.7 0 30\"><\/path><path class=\"rating-score__value rating-score__value--0\" fill=\"none\" stroke-width=\"6\" stroke-dashoffset=\"0\" stroke-miterlimit=\"10\" d=\"M40 40c8.3-8.3 8.3-21.7 0-30s-21.7-8.3-30 0 -8.3 21.7 0 30\"><\/path><text class=\"rating-score__number\" content=\"\" text-anchor=\"middle\" transform=\"matrix(1 0 0 1 25 31.0837)\" data-auto=\"app-user-score\"><\/text><\/svg>\r\n      <\/div>\r\n    <\/div>\r\n    <div class=\"sc-card-program__row\">\r\n      <span class=\"sc-card-program__description\"><\/span>\r\n    <\/div>\r\n    <div class=\"sc-card-program__row\">\r\n      <img decoding=\"async\" class=\"sc-card-program__bigpic\" src=\"\" onerror=\"this.style.display='none'\">\r\n    <\/div>\r\n    <a class=\"sc-card-program__link track-link sc-card-program-internal\" href=\"https:\/\/chrome.en.softonic.com\/\" target=\"_self\" rel=\"noopener noreferrer\"><\/a>\r\n  <\/div>\r\n<\/div>\n\n\n\n<p>Cybersecurity <a href=\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/malicious-cookie-stuffing-chrome-extensions-with-1-4-million-users\/\" target=\"_blank\" rel=\"noreferrer noopener\">researchers at McAfee<\/a> have uncovered <strong>five Google Chrome extensions<\/strong> that when installed onto Chrome secretly <strong>monitor the user\u2019s web activit<\/strong>y. Furthermore, whenever the user then visits e-commerce websites, they <strong>secretly add affiliate cookies <\/strong>to make it look like they came to the website via a referral <strong>for which the scammer receives a fee<\/strong>.<\/p>\n\n\n\n<p>Unfortunately, as McAfee reports<strong>, these extensions have been downloaded over 1.4 million times <\/strong>between them and offer a variety of different functions all designed to lure unsuspecting victims in. These include enabling multiple users to watch Netflix together, take screenshots of websites, and take advantage of website coupon savings. <strong>The full list of the false extensions <\/strong>highlighted by McAfee, comp0lete with the number of installs they\u2019ve received and their Extension IDs so you can check if you have them installed on your version of Chrome or not <strong>are as follows:<\/strong><\/p>\n\n\n\n<p class=\"has-text-align-center\"><em>Netflix Party with 800,000 installs<\/em><\/p>\n\n\n\n<p class=\"has-text-align-center\"><em>mmnbenehknklpbendgmgngeaignppnbe<\/em><\/p>\n\n\n\n<p class=\"has-text-align-center\"><em>Netflix Party 2 with 300,000 installs<\/em><\/p>\n\n\n\n<p class=\"has-text-align-center\"><em>flijfnhifgdcbhglkneplegafminjnhn \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/em><\/p>\n\n\n\n<p class=\"has-text-align-center\"><em>FlipShope Price Tracker Extension<\/em> <em>with 80,000 installs<\/em><\/p>\n\n\n\n<p class=\"has-text-align-center\"><em>adikhbfjdbjkhelbdnffogkobkekkkej <\/em><\/p>\n\n\n\n<p class=\"has-text-align-center\"><em>Full Page Screenshot Capture Screenshotting with 200,000 installs<\/em><\/p>\n\n\n\n<p class=\"has-text-align-center\"><em>pojgkmkfincpdkdgjepkmdekcahmckjp <\/em><\/p>\n\n\n\n<p class=\"has-text-align-center\"><em>AutoBuy Flash Sales<\/em> <em>with 20,000 installs<\/em><\/p>\n\n\n\n<p class=\"has-text-align-center\"><em>gbnahglfafmhaehbdmjedfhdmimjcbed<\/em><\/p>\n\n\n\n<p>Unfortunately, this news clearly indicates that <strong>you can\u2019t trust a Chrome extension simply because it has a lot of installs already<\/strong>. You need to run extra checks to make sure you are not going to fall victim to a scam. This means always checking the permissions that these apps ask for when you are installing them. If anything looks off then you should do further research into the extension itself and into alternative extensions to see what kind of permissions they are asking for.<\/p>\n\n\n\n<p>In other Chrome cybersecurity news, if you haven\u2019t updated Chrome recently you should probably do it now as <a href=\"https:\/\/chrome.en.softonic.com\/articles\/chrome-security-update-fixes-security-flaws\" target=\"_blank\" rel=\"noreferrer noopener\">Google has been patching some serious security flaws<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Chrome extensions add utility to an already extremely useful Google Chrome browser. Unfortunately, however, just like with any other sort of downloadable app or file we need to be careful when installing them onto our devices. We recently covered a fake Chrome extension that was masquerading as the plugin for a popular Windows app. Today, &hellip; <a href=\"https:\/\/cms-articles.softonic.io\/en\/chrome-extensions-stealing-your-data\/\" class=\"more-link\">Continue reading<span class=\"screen-reader-text\"> &#8220;These Chrome extensions with over 1 million downloads are stealing your data&#8221;<\/span><\/a><\/p>\n","protected":false},"author":9073,"featured_media":202441,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":"","wpcf-pageviews":0},"categories":[1015],"tags":[2378],"usertag":[],"vertical":[],"content-category":[],"class_list":["post-202435","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news","tag-app-subdomain-redirectionchrome"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/posts\/202435","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/users\/9073"}],"replies":[{"embeddable":true,"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/comments?post=202435"}],"version-history":[{"count":1,"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/posts\/202435\/revisions"}],"predecessor-version":[{"id":323281,"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/posts\/202435\/revisions\/323281"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/media\/202441"}],"wp:attachment":[{"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/media?parent=202435"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/categories?post=202435"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/tags?post=202435"},{"taxonomy":"usertag","embeddable":true,"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/usertag?post=202435"},{"taxonomy":"vertical","embeddable":true,"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/vertical?post=202435"},{"taxonomy":"content-category","embeddable":true,"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/content-category?post=202435"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}