Google has issued an urgent warning for 2 billion Chrome users. A high-severity memory vulnerability could enable attackers to target users through the websites they visit. This has been fixed and all users should update and restart now.
CVE-2025-8292 is a critical fix, but there’s a much more dangerous threat to Chrome users that is hidden from sight. And so while all desktop users must ensure they move to version 138.0.7204.183/.184 of the browser, that’s not enough to stay safe.
This threat that should worry you more comes from extensions that might appear to be officially verified, but which have been designed or hijacked to attack your device.
“Millions of users have their data stolen,” SquareX’s Vivek Ramachandran told me, as the extension-focused security team released its latest threat report. The alarming reality, he says, is that security tools do not have “visibility into the dynamic behavior of extensions at run time to protect users against the rising threat vector”
The past few years, SquareX says, “have witnessed a surge in malicious browser extensions, including the Geco Colorpick, Cyberhaven and the Great Suspender. These malicious extensions exfiltrate data, steal session cookies, spread spyware and even hijack browser sessions of victims.”
This includes extensions that were dangerous from the get-go, but also “benign extensions that turned malicious — either due to a compromise or change in ownership — exploiting trusted extensions with a wide existing installed base.”
“Most enterprises still rely on extension store labels like ‘Verified’ and ‘Chrome Featured’ to determine its security,” Ramachandran says. “This research showed that this is approach is extremely flawed as it turns out browser vendors and enterprises do not have sufficient tools to conduct extension analysis.”
This latest extension warning from SquareX echoes prior reports that focus on the hidden threats from extensions now installed by most users without any of the checks and balances applied to the browser itself. In a world of increasing AI threats, including the use of marauding browser AI agents, this is a huge risk.
“The majority of extensions today are downloaded and installed from official stores like Chrome Store,” SquareX says. But store badges “can be easily gamified by attackers with fake reviews and mass downloads. As a result, numerous Verified and Chrome Featured Extensions have been discovered as malicious, including the latest disclosure.”
Extensions are often given free rein on devices and can operate with a user’s credentials, which is a gift to attacks. “It is important to first understand the ‘superpowers’ unique to browser extensions,” Square X warns, including:
- Access HTTP-only cookies
- Bypass cross-origin request restrictions
- Observe tab updates
- Inject and run scripts on behalf of pages
- Read and/or modify any web page
- Read web page local and session storages
- Hijack functions and/or web APIs on a web page
- Inspect web requests
- Force notification and popup permissions for websites
- Take screenshots and record active tabs
All told, while updating and restarting Chrome is critical, it could very well be that the real threat to your browser and the data it accesses is hidden from view and constantly working against you. You really do need to be careful what you install.
