Time to check if you ran any of these 33 malicious Chrome extensions

At least 33 browser extensions hosted in Google ’s Chrome Web Store were surreptitiously siphoning sensitive data from 2.6 million devices.

The compromises came to light with the discovery by data loss prevention service Cyberhaven that a Chrome extension used by 400,000 of its customers had been updated with code that stole their sensitive data.

The malicious extension, available as version 24.10.4 , was available for 31 hours , starting on December 25 at 1:32 AM UTC to Dec 26 at 2:50 AM UTC .

Reader Mode is one of 13 Chrome extensions known to have used the library to collect potentially sensitive data.

The source of the compromise appears to be a code library developers can use to monetize their extensions.

In exchange for incorporating the library into the extensions, developers receive a commission from the library creator.

Cyberhaven customers have been infected with malicious extensions for Chrome and Firefox extensions.

The extensions have long remained a weak link in the security chain.

In 2019 , extensions caught stealing sensitive data from 4 million devices.

Anyone who ran one of these compromised extensions should carefully consider changing passwords and other authentication credentials.