Hello gusy! This was my first real attempt at digging into Chrome extensions. No bounty in mind, no target list, just curiosity. I…

Unlocking Hidden Attack Surfaces in the Most Overlooked Corner of Web Security

How the Mellowtel library transforms browser extensions into a distributed web scraping network, making nearly one million devices an…

ReversingLabs exposes a supply chain compromise of the VS Code ETHcode extension via two lines of malicious code in a GitHub PR, leading to malware deployment.

A Russian crypto developer lost $500K after installing a fraudulent "Solidity Language" extension for Cursor AI IDE from Open VSX, which deployed malware for remote access and data theft.

Imagine this: You’re a seasoned blockchain developer, meticulous with your security, working on a freshly installed system. You’re using…

Koi Security’s research team has unveiled GreedyBear, a threat group orchestrating industrial-scale cryptocurrency theft through a seamless blend of browser extensions, malware executables, and fr…

Enhancer for YouTube, a popular extension with 600K+ users, is leaving Firefox. The developer cites a "deeply unpleasant" and slow review process.

MailFail is a Firefox browser extension that identifies and provides commands to exploit a large number of email-related misconfigurations for the current domain and subdomain. The extension's UI popup highlights any misconfigurations in red and links to…

Mozilla has launched a new feature for Firefox Add-ons, allowing developers to quickly roll back to a previous version to fix critical bugs or security issues.

The TigerJack group is attacking developers via malicious VSCode extensions on OpenVSX. Plugins secretly steal C++ source code in real-time and deploy the CoinIMP cryptojacker.

Popular IDEs with AI assistants—such as Cursor, Windsurf, Google Antigravity, and Trae—have been found vulnerable to a supply-chain attack. These environments prompt users to install extensions th…

A fake Chrome browser extension called 'ChatGPT Ad Blocker' was harvesting conversations of ChatGPT users in the name of offering an ad-free experience.

Over 130,000 users are at risk from fake TikTok downloader extensions on Chrome and Microsoft Edge with scammers spying and stealing user data.

The GlassWorm campaign has resurfaced within the developer community, though the adversaries have adopted a more surreptitious operational

Cursor AI editor found storing API keys and tokens in an unprotected SQLite database, allowing extensions to steal credentials silently. CVSS 8.2. No patch yet.

The ClaudeBleed vulnerability allows hackers to bypass Claude for Chrome guardrails to exfiltrate private Google Drive and Gmail data.

GitHub Breach: TeamPCP stole 3,800 internal repositories through a malicious VS Code extension and is now selling the data online for $95,000.

A Google Notes browser extension is replacing copied crypto payment details, putting wallet transfers at risk for Chrome, Brave, and Microsoft Edge users.

Cybersecurity’s Blind Spot in the Age of AI