How to Check if a Chrome Extension Has Been Compromised or Sold

An extension you've trusted for years can change overnight. Popular extensions are often bought by new owners, and developer accounts are sometimes hacked. Either way, the update installs itself. Here's how to spot it.

How good extensions go bad

• Sold to a new owner. Developers get offers for extensions with many users. Some buyers add tracking, ads or affiliate redirects. The Great Suspender, a popular tab extension, was sold and later removed by Google in 2021 for containing malware.
• Hacked developer account. In December 2024, attackers phished the developer account of security company Cyberhaven and pushed a malicious update to its extension, along with several others.
• A slow change. Sometimes the same developer starts collecting data to make money from a free extension.

Warning signs

• Chrome turns the extension off because an update asks for new permissions. Don't approve without reading why.
• New ads, pop-ups or redirects, or your search engine or new tab page changes on its own.
• Affiliate codes appear in shopping links you didn't click from an affiliate site.
• A new name in "Offered by" on the Web Store page, or a privacy policy that changed.
• Recent reviews complaining about new behavior after years of good ones.
• Chrome warns you. Safety Check flags extensions that were removed from the Web Store or marked as malware.

How to check an extension

1. Open its Chrome Web Store page. Check who it's offered by, the "Updated" date and the version notes.
2. Read the newest reviews, sorted by most recent.
3. At chrome://extensions, open Details and look at its permissions and site access.
4. Run Settings → Privacy and security → Safety Check.
5. Search the extension's name with "sold", "malware" or "acquired".

If you think one has been compromised

1. Remove it at chrome://extensions.
2. Check your search engine, homepage and new tab settings, and reset them if needed.
3. If it could read all sites, change passwords for important accounts and sign out of other sessions. Turn on two-step verification.
4. Look for a trustworthy replacement, or check whether Chrome can do the job itself.

Lower your risk

• Keep fewer extensions, and remove ones you no longer use.
• Set site access to "On click" or specific sites where you can.
• Prefer extensions that work locally and make no network requests.

More in how to tell if an extension is spying on you and how extension auto-updates work.