10 million users at risk: How a malicious ad-blocker became a gateway for cybercriminals

MarGib October 15, 2026

🌐 🇵🇱 Polski · 🇬🇧 EN

A plugin with 10 million installs, advertised as an ad-blocking tool, turned out to be an attack vector. How did this happen, and why do browser users continue to downplay the risks associated with extensions?

Illustration showing a magnifying glass over a browser plugin icon, revealing hidden malicious code and shadows of figures attempting to steal data from a computer screen. — Malicious browser extensions may look innocent, but they hide serious threats. How can you recognize them?

The ad-blocker that became a tool for cybercriminals

In June 2026, The Hacker News published an alarming report about a Chrome plugin that had enjoyed the trust of millions of users for years. "adblocker for Chrome" – as it was named – was not a legitimate tool, but a trap set by unknown perpetrators. Although the details of the attack remain unclear, this incident fits into a long series of similar cases that demonstrate how easily trust in popular extensions can be exploited.

The official source does not provide the exact name or identifier of the plugin, but an analysis of previous incidents allows us to reconstruct a likely scenario. In the past, attacks on browser extensions have taken various forms – from hijacking developer accounts to injecting malicious code through dependencies. In this case, one of these methods seems most probable, although without a detailed report, it is difficult to point to a specific mechanism.

How do attackers take control of plugins?

History shows that cybercriminals have several proven ways to infiltrate popular extensions:

Phishing and social engineering: In 2017, the creators of the Copyfish plugin fell victim to a fake email that allowed attackers to take over their Chrome Web Store account. As a result, a malicious update reached 300,000 users, installing adware on their computers (source: The Register).
Vulnerabilities in dependencies: In 2021, the Nano Adblocker plugin was infected via an external library it utilized. Although the plugin itself was open-source, one of its dependencies contained malicious code that could steal user data (source: github).
Developer account hijacking: In 2020, the Web Developer plugin (1 million users) was hacked after attackers gained access to its creator's account. The result? Installation of "browser hijacker" malware that redirected users to malicious sites (source: ZDNet).

In the case of the 2026 incident, the most likely scenario is the hijacking of a developer account or the exploitation of a vulnerability in the update process. Attackers could also have used typosquatting – creating a plugin with a name deceptively similar to a legitimate tool (e.g., "adblock" instead of "ublock Origin").

Why did 10 million users not notice the problem?

The scale of the incident – 10 million installs – might be shocking, but it is no surprise to security experts. Users often downplay the risks associated with plugins, guided by several false beliefs:

"If it's in the official store, it must be safe": Unfortunately, the verification process in the Chrome Web Store is not perfect. While Google introduced mandatory code reviews for new plugins in 2022, older extensions often remain unmonitored.
"An ad-blocker can't do harm – it only blocks ads": In reality, many plugins have much broader permissions than their basic function suggests. For example, an ad-blocking extension may have access to all visited pages, browsing history, and even data entered into forms.
"I have an antivirus, so I'm safe": Traditional antivirus software often fails to detect threats related to plugins because they operate within the browser context and do not always leave traces on the disk.

Furthermore, users rarely check plugin permissions before installing them. Yet, excessive permissions are the most common cause of problems.

What permissions should a plugin have, and why are they often abused?

Every Chrome plugin requires specific permissions to function. The problem is that many of them have access to significantly more data than is necessary. Here are the most common permissions and their potential risks:

"<all_urls>": Allows reading and modifying the content of all visited pages. Theoretically needed for ad-blockers, but can be used to steal data from forms or inject malicious code.
"tabs": Enables reading and modifying browser tabs. Attackers can use this permission to open new tabs with malicious sites or track user activity.
"webRequest": Allows capturing and modifying network requests. While essential for ad-blockers, it can be used to replace ads with malicious ones or redirect users to phishing sites.
"storage": Grants access to the browser's local storage, including cookies and session data. Can be used for identity theft or hijacking accounts on websites.
"downloads": Enables downloading files without the user's knowledge. Attackers can use this permission to install malware.

For example: the legitimate ublock Origin plugin has only three permissions: "webRequest", "storage" and "<all_urls>". This is enough to block ads but does not grant access to user data. Meanwhile, many suspicious plugins ask for much more, e.g., "tabs" and "downloads", which should raise suspicions.

How to check plugin permissions before installation?

Here are a few simple steps that will help avoid problems:

Before installing a plugin, go to its page in the Chrome Web Store and scroll to the "Permissions" section. If you see anything more than "webRequest", "storage" and "<all_urls>", consider whether you really need this plugin.
Check the number of installs and ratings. Plugins with a low number of reviews (e.g., under 10,000) may be less trustworthy.
Use code analysis tools such as CRXcavator. They scan plugins for potential threats and show which permissions are actually being used.
Regularly review the list of installed plugins and remove those you don't use. In Chrome, you can do this by typing in the address bar: chrome://extensions.

What were the consequences of the attack and did Google react?

The official source does not provide details regarding the consequences of the 2026 attack, but based on previous incidents, it can be assumed that the following may have occurred:

Theft of login credentials for websites (e.g., banks, social media).
Installation of malware, including ransomware or spyware.
Redirecting users to phishing sites or sites with drive-by download exploits.
Leakage of session cookies, which allows account hijacking without knowing the password.

As for Google's reaction, the company has been criticized in the past for being slow to act. For example, the The Great Suspender plugin was removed from the Chrome Web Store only two months after malicious code was detected, despite having 2 million users (source: Ars Technica). In 2022, Google introduced mandatory code reviews for new plugins, but older extensions can still pose a threat.

In the case of the described incident, there is no official statement from Google or the plugin's creators. This is unfortunately a common practice – developers often deny problems or simply remain silent to avoid liability.

Other popular plugins that became attack vectors

The 2026 incident is not isolated. Here are some other cases that show how dangerous browser plugins can be:

Plugin name	Number of users	Date of incident	Consequences
The Great Suspender	2 million	2021-02	Session data theft, redirects to malicious sites
Web Developer	1 million	2020-02	Installation of "browser hijacker" malware
Copyfish	300k	2017-07	Adware, redirects to advertising sites
Nano Adblocker	300k	2021-03	Malicious code in dependencies, potential data theft
Hola VPN	8 million	2020-06	Selling user bandwidth, potential data interception

It is worth noting that not all of these plugins were malicious from the start. Many of them, like The Great Suspender or Nano Adblocker, gained popularity as legitimate tools before being hijacked or infected.

How to protect yourself from malicious plugins?

Here are some practical tips that will help minimize the risk:

1. Install only trusted plugins

The safest choice is open-source plugins that are regularly updated and have a large user community. Examples:

ublock Origin – an open-source ad-blocker with minimal permissions.
HTTPS Everywhere – forces encrypted connections on sites that do not do so by default.
Privacy Badger – blocks tracking scripts and cookies.

2. Regularly update your browser and plugins

Many attacks exploit vulnerabilities in older software versions. Make sure you have automatic updates enabled:

In Chrome: Ustawienia → O Chrome → Automatyczne aktualizacje.
In Firefox: Ustawienia → Ogólne → Aktualizacje.

3. Use plugin analysis tools

Tools such as CRXcavator or Extension Workshop (for Firefox) allow you to check if a plugin contains suspicious code.

4. Limit the number of installed plugins

The more plugins you have installed, the larger the attack surface. Regularly review your list of extensions and remove those you don't use.

5. Use incognito mode for sensitive activities

Incognito mode does not save browsing history or cookies, which can help protect against some types of attacks. However, remember that it does not protect against all threats (e.g., keyloggers).

6. Enable two-factor authentication (2FA)

Even if an attacker gains your login credentials, 2FA can prevent them from accessing your accounts. Many services, such as Google, Facebook, or Netflix, offer this option in security settings.

If you want to learn more about new login policies, read our article: Netflix introduces mandatory 2FA from July 2026 – what you need to know about the new login rules.

Why popularity does not mean security

The 2026 incident shows that even plugins with millions of installs can pose a threat. Popularity often goes hand in hand with a larger attack surface – the more users, the greater the temptation for cybercriminals. Furthermore, a high number of installs can provide a false sense of security, leading users to ignore potential threats.

It is also worth remembering that many plugins are developed by small teams or individual developers who do not always have the resources for regular security audits. As a result, even legitimate tools can contain vulnerabilities that will be exploited by attackers.

That is why it is so important not to rely solely on the number of installs or store ratings. Always check permissions, read reviews (especially negative ones), and use code analysis tools.

Summary: Are browser plugins safe?

Browser plugins can be extremely useful, but they carry real risks. The 2026 incident, like previous attacks on The Great Suspender or Web Developer, shows that even popular extensions can become vectors for cybercriminals.

The key to security is awareness and caution. Before installing any plugin, it is worth asking yourself a few questions:

Do I really need this plugin?
What permissions does it need to function?
Are the plugin creators trustworthy?
Is the plugin regularly updated?

If you are not sure about the answer to any of these questions, it is better to skip the installation. Remember that in today's world, cybersecurity is not just a matter of technology, but also of common sense.

If you are interested in the topic of online security, also read our guide: Cyber threat landscape 2026: A guide for administrators on the new attack surface.