Cybersecurity researchers have uncovered 19 browser extensions—18 for Google Chrome and one for Microsoft Edge—that secretly steal crypto wallet secrets and drain funds from victims’ accounts over the course of a coordinated six-month campaign.[1][2] The add-ons were distributed through official browser extension stores, masquerading as legitimate utilities while embedding code designed to exfiltrate recovery phrases and manipulate transactions.[1][2]
The campaign was detailed by Socket security researcher Karlo Zanki, who found that the extensions share striking similarities in code structure and operational tradecraft, pointing to a single threat actor or closely linked group.[1] Fourteen of the extensions appear to have been created outright by the attacker, while five were purchased from their original developers and later repurposed with malicious logic, a pattern that underscores the growing practice of weaponizing existing extension install bases.[1] Intelligence reporting on parallel activity describes related browser add-ons that intercept wallet addresses copied to the clipboard and silently replace them with attacker-controlled addresses mid-transaction, enabling seamless theft of outgoing payments.[2]
Once installed, the rogue extensions are engineered to capture sensitive wallet data, including seed phrases and private keys, from browser text fields and local storage, before sending it to attacker infrastructure where funds can be siphoned at scale.[1][2] The risk is amplified by long-standing weaknesses in how browsers and some wallet extensions handle secret recovery phrases, exemplified by the “Demonic” flaw in several popular crypto wallets, tracked as CVE-2022-32969.[11] In that case, MetaMask, Phantom and other projects warned that browsers were caching non-password text field contents—including recovery phrases—as part of session restore, potentially exposing complete wallets to anyone who could access the underlying system.[11] Wallet vendors have since pushed updates, with MetaMask fixing the issue in extension version 10.11.3, xDefi in 13.3.8, and Phantom in April 2022, but the incident illustrates how browser-centric storage of secrets remains a fertile target for attackers.[11]
Unlike software flaws that receive formal CVE identifiers, the malicious Chrome and Edge extensions are better viewed as abuse of the extension ecosystem rather than discrete vulnerabilities, and no CVEs have been assigned to these campaigns.[2] Still, recent bugs in Chrome’s Extensions component highlight just how dangerous a malicious add-on can be: CVE-2026-13774, a use-after-free flaw in Chrome prior to version 150.0.7871.47, carries a CVSS v3.1 score of 8.1 and allows arbitrary code execution when a user is convinced to install a crafted extension.[3] Other issues, such as CVE-2026-17781, which permits cross-origin data leakage via a malicious extension (CVSS v3.1 score 4.3), and CVE-2026-11269, an inappropriate implementation in the Extensions component with a CVSS score of 7.1, underline the broader risk posed when untrusted extensions gain access to browser privileges.[6][15] Notably, CVE-2026-11269 is not listed in CISA’s Known Exploited Vulnerabilities catalog, suggesting no evidence of widespread exploitation yet, but it reinforces the need for strict extension hygiene among users and enterprises.[15]
For defenders, the discovery of these 19 wallet-draining extensions highlights a multi-layered threat that combines social engineering, supply-chain compromise and platform-level weaknesses.[1][2] By buying existing extensions and pushing silent updates, attackers can inherit tens of thousands of users without the friction of building a new audience from scratch, complicating detection for both end users and store operators.[1] Organizations relying on browser-based crypto tools face heightened exposure, as corporate browsers often run with broad permissions and limited oversight of extension behavior, creating an attractive environment for operators of financially motivated campaigns.[2]
Users who rely on Chrome or Edge for managing cryptocurrency should immediately review installed extensions, remove anything unfamiliar or no longer needed, and assume compromise for any wallet that has interacted with suspicious add-ons by rotating recovery phrases and migrating funds to new wallets. Security teams should tighten policies around extension installation, favoring centrally managed whitelists and monitoring for anomalous browser activity tied to clipboard access or wallet-related domains.[2] Keeping Chrome updated against extension-related flaws such as CVE-2026-13774, CVE-2026-17781 and CVE-2026-11269, and ensuring wallet extensions are running patched versions that address issues like CVE-2022-32969, reduces the overall attack surface even when the underlying problem stems from malicious, rather than merely vulnerable, code.[3][6][11][15]
References
- 19 Chrome and Edge Extensions Found With Wallet-Stealing and …
- SCC Intelligence Briefing SCC-CAM-2026-0605
- CVE-2026-13774
- CVE-2026-17781 | Tenable®
- MetaMask, Phantom warn of flaw that could steal your …
- CVE-2026-11269 – Vulnerability Details – OpenCVE
