“I think it’s a mistake to think of the risk as just being about extensions,” he added. “It’s the fundamental DNA of these browsers that is bad; the companies aren’t incented to pay enough attention to the problems, and bad extensions are just the straw that breaks cybersecurity’s back.”
How it works
CISOs have a tough challenge: It’s not hard to fool an employee into downloading and installing a malicious extension for any browser; browser extensions are supposed to be attractive add-on utilities such as password managers or AI productivity assistants. They are promoted in phishing and smishing messages, social media posts and, when threat actors are able, uploaded to marketplaces such as the Google Chrome Web Store. They can be malware disguised as a legitimate extension or can be a compromised version of one.
In AI Sidebar Spoofing, says the SquareX report, once a victim opens a new AI browser tab, the malicious extension injects JavaScript into the web page to create a fake sidebar that looks exactly like a legitimate sidebar. When the user enters a prompt into the spoofed sidebar, the extension hooks into its AI engine. But if the prompt requests certain instructions or guides, the responses can be manipulated to include additional instructions to the user. So, for example, if the user asks for good file sharing sites, the malicious extension might provide a link to the attacker’s file sharing site that requests high risk OAuth permissions that it can harvest. In the hands of a hacker, they could allow access to the victim’s email.
