Cookies in one minute
A cookie is a short piece of data a website stores in your browser. A session cookie often acts like a temporary badge: while it is valid, the site treats you as already signed in, so you are not typing your password on every click.
Websites can mark some cookies HttpOnly so normal page scripts cannot read them—this blocks many classic website hacks. Browser extensions are different: with the right permission, an extension can still reach many of those cookies through the browser’s privileged APIs. That is why extension risk is a separate problem from “malicious ads on a page.”
Reported scale (with sources)
The numbers below come from specific investigations or peer-reviewed preprints—treat them as snapshots, not a live dashboard. They illustrate that cookie-capable extensions operate at massive install scale and that criminal campaigns repeatedly pair extensions with cookie theft.
- 4.3M
Users touched by a seven-year malicious-extension campaign (ShadyPanda)
Security firm Koi reported that Chrome and Edge users were impacted across multiple phases; coverage noted spyware, backdoors, URL and fingerprint collection, and—in at least one cluster—explicit cookie exfiltration alongside search hijacking. See The Register summary.
- 2,300+
Users across five coordinated malicious extensions (enterprise HR/ERP)
Socket’s research described extensions targeting Workday, NetSuite, and SuccessFactors, combining cookie exfiltration, DOM tricks to block admin pages, and (in one variant) injecting stolen cookies back with
chrome.cookies.set. One listing alone reached about 1,000 users. Full write-up: Socket. - 100M+
Installs in the “hundreds of millions” for extensions with risky cookie-related APIs
Academic work analyzing Chromium extensions found that add-ons able to abuse APIs tied to cookie theft or modification collectively reach hundreds of millions of users—not because all are malicious, but because the same powerful APIs legitimate tools use are what malware needs. Paper: arXiv:2405.06830.
What an extension can actually do with cookie access
In Chromium browsers, the “cookies” permission unlocks the chrome.cookies family of calls. In practice, depending on paired host permissions, a developer can:
- List cookies for a site (for example every cookie on
*.your-bank.example). - Read values of session and preference cookies, including many marked HttpOnly for web pages.
- Change or delete cookies—log someone out, swap in another session, or break security settings.
- Listen for updates (login, logout, token refresh) and react immediately—Socket documented a 60-second timer re-checking login state in addition to live listeners.
- Ship stolen values out over the network using
fetchor similar, often alongsidedeclarativeNetRequestto alter requests without you seeing page-level JavaScript.
None of this requires guessing your password. If the session cookie still works, an attacker imports it into another browser profile and may appear as you, sometimes bypassing MFA for that session—because the site already finished the “second factor” step when you logged in.
Risk outcomes (plain language)
Account takeover without a phishing email
Silent export of session tokens from HR, finance, or cloud consoles while you work normally.
Long-lived access
If tokens keep refreshing, automated timers and cookie listeners keep the attacker synced—Socket described periodic re-extraction.
Blocking your recovery
Some campaigns blank admin or security pages so you cannot rotate passwords or review device sessions while theft continues.
Supply-chain surprises
A once-clean extension can turn malicious after an update—large historical campaigns (e.g. ShadyPanda reporting) relied on trusted install counts before pushing harmful code.
Real-world patterns (documented)
- Enterprise SaaS session theft. Coordinated Chrome extensions targeting HR/ERP platforms exfiltrated authentication cookies on a schedule, encrypted command traffic, and interfered with security UI—see Socket’s January 2026 analysis.
- Long-haul extension campaigns. Reporting on Koi’s ShadyPanda research described millions of installs, surveillance behavior, and cookie exfiltration in specific offshoots—see The Register.
- Research proof points. Public demonstrations (e.g. “Cookie-Bite”) showed extensions stealing Entra ID session cookies to illustrate MFA bypass scenarios—see BleepingComputer. These are controlled proofs but map to the same cookie mechanism criminals abuse.
What actually helps
- Fewer extensions. Remove anything you no longer need; revoke broad “read all sites” tools unless the benefit is clear.
- Read the permission bundle. Cookie access plus networking plus scripting is a different story than cookies alone on one domain.
- Prefer publisher identity you can verify (company site, support channel), not anonymous “helper” brands.
- Enterprise: allowlist extension IDs, monitor updates, and segment admin tasks to hardened profiles.
- After suspected theft: sign out everywhere the app allows, rotate credentials, review active sessions, and remove suspicious add-ons before trusting the browser again.
For a broader review checklist, see our extension permissions guide and how to analyze an extension.
Sources for figures and incidents
Related extension guides
These topics often show up together in real extensions and abuse reporting—reading them as a set makes it easier to judge combined risk.
- Browser extensions & network traffic (full guide)
Host permissions, fetch, declarativeNetRequest, redirects, documented abuse at reported scale, and mitigations.
- Browser extensions & scripts / DOM (full guide)
Content scripts, scripting API, what “read and change all your data” means, cited incidents, and how to reduce scope.
- “Read and change all your data on every website” — what it really means
Plain-language deep dive on host permissions that cover every website: capabilities, real abuse cases, Chrome/Mozilla documentation, and independent research citations.
- Browser extensions & open tabs (full guide)
How extension tab permissions work (open tabs, URLs, navigation): capabilities, documented incidents with cited user counts, token-in-URL risks, and mitigations.
Spot risky extensions earlier
eSafe focuses on extension visibility, cutting tracking noise, and safer checkouts—use it together with tight install hygiene, not as a replacement for enterprise allowlisting or incident response.