eSafe · Secure Browsing Assistant
Understand what your browser is exposing — and how to stay in control.
Featured guide
Researchers describe a developer-focused infection chain that steals secrets, deploys a RAT, and force-installs a Chrome extension posing as Google Docs Offline—harvesting cookies, DOM, bookmarks, clipboard access, browsing history, and more.
Browse by topic
How a chained allowlist and DOM XSS could route prompts into the Claude sidebar without a visible click, what changed in extension 1.0.41, and what to watch for in AI browser extensions.
Two Chrome extensions reportedly turned malicious after publisher changes—remote script delivery, header stripping, and a ClickFix-style pivot. What happened and what to check on your own browser.
A patched Chrome flaw ("Glic Jack") showed how a malicious extension could reach a high-trust browser surface—the Gemini Live panel—via WebView and request rules. What broke, what Google fixed, and why it matters.
Reporting bundled Socket’s 10Xprofit e-commerce cluster, Symantec’s clipboard and search hijackers, and LayerX’s ChatGPT Mods token grabbers—plus context on store policy and AI-themed risk.
Huntress described KongTuke’s CrashFix chain—a store-listed ad blocker clone, deliberate browser stress, and ClickFix-style commands leading to ModeloRAT on some victims. What the loop looks like and how to break it.
Socket described five Chrome add-ons posing as cloud HR/ERP access helpers—continuous cookie exfiltration, DOM blocks on dozens of security URLs, and one variant that could inject stolen sessions.
OX Security flagged add-ons with huge install counts that allegedly exfiltrated ChatGPT and DeepSeek threads under an “anonymous analytics” pretext—plus why “legitimate” extensions are joining the same data class.
A post-mortem tied to the Shai-Hulud wave described leaked GitHub secrets, a stolen Chrome Web Store key, and a trojanized extension update—what broke, how seeds were exfiltrated, and what users can verify.
Tunnels, DNS, logging, and threat models—plus what an extension-only VPN can and cannot hide compared to a full-device client.
How researchers clustered over a hundred Chrome extensions that inject into web.whatsapp.com to automate bulk messaging—high-risk for the platform, annoying for users, and a lesson in clone economics.
Symantec highlighted extensions that sent data over plain HTTP or shipped secrets in client-side code—what leaks, why Wi‑Fi matters, and what developers should do instead.
How a North Korea–linked campaign reportedly used a Chrome extension masquerading as Google Translate to collect credentials, cookies, and screenshots—mostly as context for risk, not panic.
Short on-ramps if you are new to extension safety—no scare tactics, just clarity.
Manifest, permissions, and where code runs—so install prompts make sense.
Host access, tabs, storage, and network—plain language, real examples.
Cookies, storage, and what extensions can observe as you browse.
A short checklist: publisher, updates, reviews, and permission fit.
Scan your extensions and monitor risks in real time—on your terms, with clear explanations.
Add eSafe to ChromeFree · No signup · ~60s scan
We don’t sell your data. eSafe is built for transparency and local-first scanning where possible.
