They had a combined user count of 55 million and included Autoskip for YouTube (9 million active users), Soundboost (6.9 million), and Crystal Ad block (6.8 million).Īvast reported the extensions to Google after it confirmed they contained malicious code. He explained the code was designed to activate 24 hours after the extension was installed, with its likely intention being the injection of ads.Ī couple of weeks after discovering the code in the PDF Toolbox extension, Palant wrote in a follow-up article that he had found 18 malicious browser extensions using similar code.

Palant wrote that the code allows the 'serasearchtopcom' website to inject arbitrary JavaScript code into all websites that users of the extension visit. The company has just removed 32 malicious extensions from the Chrome Web Store that appear to have been installed a combined 75 million times.Īs is often the way in these cases, the extensions were able to hide their hidden code from users by performing their intended functions, reports BleepingComputer.Ĭybersecurity researcher Wladimir Palant previously wrote that he had discovered obfuscated code in the PDF Toolbox extension for Google Chrome, which had a Chrome Web Store rating of 4.2 and more than 2 million users. In brief: It's not just the Play Store where Google has to deal with malicious software sneaking past its safeguards.

Download chrome web store