Security researchers at SquareX have revealed a significant security flaw that allows malicious browser extensions, dubbed “Polymorphic Extensions,” to disguise as trusted extensions. By replicating legitimate interfaces and icons, attackers trick users into granting access to sensitive data.
Google has almost completed its phased rollout of disabling Manifest V2 extensions in Chrome stable version, marking a significant transition in the browser’s extension ecosystem.
Mozilla has reaffirmed its commitment to supporting browser extensions built on Manifest V2 APIs, even as Google phases them out in favor of Manifest V3.
SquareX’s research team has identified a critical security flaw in browser extensions, called “Browser Syncjacking.” This vulnerability enables attackers to take full control of a user’s browser and device through a series of hijacking stages.
