threats · cookies · extensions

Extension access to cookies: what can go wrong

Cookies are the small stickers your browser keeps so sites remember you—especially “session” cookies that mean you stay logged in. Extensions sit inside the browser with special powers: many can read or change those cookies even when ordinary websites cannot. This article explains, in plain language, what that access allows, real attack patterns, published figures from security research, and how to reduce risk.

Cookies in one minute

A cookie is a short piece of data a website stores in your browser. A session cookie often acts like a temporary badge: while it is valid, the site treats you as already signed in, so you are not typing your password on every click.

Websites can mark some cookies HttpOnly so normal page scripts cannot read them—this blocks many classic website hacks. Browser extensions are different: with the right permission, an extension can still reach many of those cookies through the browser’s privileged APIs. That is why extension risk is a separate problem from “malicious ads on a page.”

Reported scale (with sources)

The numbers below come from specific investigations or peer-reviewed preprints—treat them as snapshots, not a live dashboard. They illustrate that cookie-capable extensions operate at massive install scale and that criminal campaigns repeatedly pair extensions with cookie theft.

  • 4.3M

    Users touched by a seven-year malicious-extension campaign (ShadyPanda)

    Security firm Koi reported that Chrome and Edge users were impacted across multiple phases; coverage noted spyware, backdoors, URL and fingerprint collection, and—in at least one cluster—explicit cookie exfiltration alongside search hijacking. See The Register summary.

  • 2,300+

    Users across five coordinated malicious extensions (enterprise HR/ERP)

    Socket’s research described extensions targeting Workday, NetSuite, and SuccessFactors, combining cookie exfiltration, DOM tricks to block admin pages, and (in one variant) injecting stolen cookies back with chrome.cookies.set. One listing alone reached about 1,000 users. Full write-up: Socket.

  • 100M+

    Installs in the “hundreds of millions” for extensions with risky cookie-related APIs

    Academic work analyzing Chromium extensions found that add-ons able to abuse APIs tied to cookie theft or modification collectively reach hundreds of millions of users—not because all are malicious, but because the same powerful APIs legitimate tools use are what malware needs. Paper: arXiv:2405.06830.

What an extension can actually do with cookie access

In Chromium browsers, the “cookies” permission unlocks the chrome.cookies family of calls. In practice, depending on paired host permissions, a developer can:

  • List cookies for a site (for example every cookie on *.your-bank.example).
  • Read values of session and preference cookies, including many marked HttpOnly for web pages.
  • Change or delete cookies—log someone out, swap in another session, or break security settings.
  • Listen for updates (login, logout, token refresh) and react immediately—Socket documented a 60-second timer re-checking login state in addition to live listeners.
  • Ship stolen values out over the network using fetch or similar, often alongside declarativeNetRequest to alter requests without you seeing page-level JavaScript.

None of this requires guessing your password. If the session cookie still works, an attacker imports it into another browser profile and may appear as you, sometimes bypassing MFA for that session—because the site already finished the “second factor” step when you logged in.

Risk outcomes (plain language)

  • Account takeover without a phishing email

    Silent export of session tokens from HR, finance, or cloud consoles while you work normally.

  • Long-lived access

    If tokens keep refreshing, automated timers and cookie listeners keep the attacker synced—Socket described periodic re-extraction.

  • Blocking your recovery

    Some campaigns blank admin or security pages so you cannot rotate passwords or review device sessions while theft continues.

  • Supply-chain surprises

    A once-clean extension can turn malicious after an update—large historical campaigns (e.g. ShadyPanda reporting) relied on trusted install counts before pushing harmful code.

Real-world patterns (documented)

  • Enterprise SaaS session theft. Coordinated Chrome extensions targeting HR/ERP platforms exfiltrated authentication cookies on a schedule, encrypted command traffic, and interfered with security UI—see Socket’s January 2026 analysis.
  • Long-haul extension campaigns. Reporting on Koi’s ShadyPanda research described millions of installs, surveillance behavior, and cookie exfiltration in specific offshoots—see The Register.
  • Research proof points. Public demonstrations (e.g. “Cookie-Bite”) showed extensions stealing Entra ID session cookies to illustrate MFA bypass scenarios—see BleepingComputer. These are controlled proofs but map to the same cookie mechanism criminals abuse.

What actually helps

  • Fewer extensions. Remove anything you no longer need; revoke broad “read all sites” tools unless the benefit is clear.
  • Read the permission bundle. Cookie access plus networking plus scripting is a different story than cookies alone on one domain.
  • Prefer publisher identity you can verify (company site, support channel), not anonymous “helper” brands.
  • Enterprise: allowlist extension IDs, monitor updates, and segment admin tasks to hardened profiles.
  • After suspected theft: sign out everywhere the app allows, rotate credentials, review active sessions, and remove suspicious add-ons before trusting the browser again.

For a broader review checklist, see our extension permissions guide and how to analyze an extension.

Sources for figures and incidents

These topics often show up together in real extensions and abuse reporting—reading them as a set makes it easier to judge combined risk.

Browse all extension power guides

Spot risky extensions earlier

eSafe focuses on extension visibility, cutting tracking noise, and safer checkouts—use it together with tight install hygiene, not as a replacement for enterprise allowlisting or incident response.