Browser Extension Threat Statistics: Malicious Campaigns, Installs and Enterprise Exposure

Malicious and hijacked browser extensions reach millions of users per campaign, yet most organisations cannot say how many extensions their staff run or what those extensions can read. This page gathers the figures that matter for that decision from their primary publishers: Google's own Chrome Web Store malware rate, the Stanford and CISPA academic study of the store, LayerX's 2025 enterprise extension telemetry, and the researcher disclosures behind the largest campaigns of 2024 and 2025 (Cyberhaven, the GitLab-reported hijacks, RedDirection and ShadyPanda). Every figure carries its publisher and data year in the same sentence or table row. It is for endpoint, identity and browser security teams building a case for extension inventory and allowlisting. Controls are covered in depth in the Browser Extension Security Guide; this page is the evidence. Last reviewed: November 2026.

Key takeaways

• Almost everyone runs extensions: LayerX's 2025 report finds 99% of enterprise users have at least one browser extension installed and 52% have more than ten.
• A small malware rate is still a large number: Google reported in June 2024 that fewer than 1% of Chrome Web Store installs were found to include malware, while the Stanford and CISPA study estimates security-noteworthy extensions reached almost 350 million users.
• Campaigns now run to millions of installs: the GitLab-reported hijacks reached more than 3.2 million users, RedDirection more than 2.3 million, the Cyberhaven-linked campaign about 2.6 million and ShadyPanda 4.3 million.
• Store badges are not a safety signal: RedDirection and ShadyPanda extensions carried Featured or Verified status before or while they turned malicious.
• Abandonment is the norm: 51% of extensions had no update in over 12 months (LayerX 2025) and about 60% were never updated (Stanford and CISPA), which leaves them open to sale or takeover.

Headline statistics

Statistics by theme

Store scale and the malware rate

LayerX counts approximately 145,000 extensions in the Chrome Web Store, about 43,000 Mozilla add-ons and about 13,000 Microsoft Edge extensions (2025). Install counts are highly skewed: 88.5% of Chrome extensions have fewer than 1,000 users and only 0.43% of extensions have more than one million installs. That skew matters, because one hijacked popular extension can reach more users than thousands of obscure ones.

Google's figure of fewer than 1% of installs including malware (2024) is a share of installs, not of extensions, and it describes what Google found. Google describes an automated and a human review before publication and a Safety Check panel that flags extensions removed from the store, marked as malware or unpublished by the developer. The Stanford and CISPA study takes a wider lens, counting "security-noteworthy" extensions: malware, policy-violating extensions and vulnerable extensions together.

Enterprise exposure

LayerX combines public store data with telemetry from its own enterprise customers, so the enterprise figures describe organisations that already chose to buy a browser security product. Read them as a strong indication, not a census.

Cookie and identity permissions show up in enterprise browsers at more than twice their store-wide rate. Those are exactly the permissions that let an extension read session cookies and act as the user in SaaS applications, the technique ATT&CK lists as T1539 Steal Web Session Cookie and T1185 Browser Session Hijacking.

Publishers and maintenance

• Anonymous publishers: 54% of extension publishers are identified only by a free Gmail account, rising to 64% for GenAI extensions (LayerX 2025).
• One-off developers: 79% of developers have published a single extension; about 2% have published more than five (LayerX 2025).
• No privacy policy: 58% of extensions publish no privacy policy, and the same 58% applies to password manager extensions (LayerX 2025).
• Stale code: 51% of extensions had no update in more than 12 months, and nearly 25% combine that with a Gmail-only publisher (LayerX 2025).

An unmaintained extension with a large install base and an anonymous publisher is the profile buyers of extensions look for. The new owner pushes an update and every browser installs it automatically.

GenAI extensions

LayerX reports that more than 20% of enterprise users have a GenAI extension, 45% of those have more than one, 58% of GenAI extensions request high or critical permissions and 41% are younger than six months (2025). GenAI assistants that read whole pages ask for broad access by design, which is why they need a separate review track. See the AI Browser Extensions Security Guide.

Campaigns, 2024 to 2025

The Cyberhaven Chrome extension breach shows the speed: the malicious version 24.10.4 was published on 24 December 2024 and detected about 30 hours later, then removed within an hour. Every user with automatic updates received it in that window. The lesson is customer-side as much as publisher-side: an allowlist pinned to reviewed extension IDs still auto-updates, so detection of new outbound domains matters as much as the allowlist.

In the GitLab case Google removed the extensions in January 2025, but removal from the store did not uninstall them from users' browsers. In ShadyPanda, three of the backdoored extensions had been uploaded in 2018 and 2019 and had earned Featured and Verified status, and the Edge extension WeTab alone had about 3 million installs and sent data to 17 domains.

Two routes to the same outcome

The four campaigns fall into two patterns, and they call for different controls.

• Publisher account takeover: in the Cyberhaven-linked campaign and the GitLab-reported hijacks, attackers phished extension developers and pushed a malicious update through a legitimate account. The extensions were trustworthy until the day they were not. The control that helps most is detection after update: new permissions requested, new domains contacted, new content scripts injected.
• Long con by the owner: in RedDirection and ShadyPanda the extensions worked as advertised for months or years, collected reviews and badges, then changed behaviour. Reputation built over time is the attack. The control that helps most is a short allowlist with owners who re-review high-permission extensions on a schedule.

Both patterns share the delivery mechanism, the browser's silent automatic update, and both reached hundreds of thousands of users before disclosure. Most organisations rely on automatic updates to receive security fixes, which makes post-update monitoring the practical safeguard.

What the numbers mean for defenders

For a business case, pair one exposure figure (99% of users, 53% with high-risk scope) with one campaign figure and its date. Small organisations get most value from a managed browser policy that blocks all extensions by default and allows a short reviewed list, using Chrome's ExtensionInstallAllowlist or ExtensionSettings policies or the Edge equivalents. Large organisations with thousands of extension IDs need risk scoring and a request workflow; see the Browser Extension Security Guide for the rollout and the Malicious Browser Extension Incident Playbook for response.

Where identity fits

Extensions with cookie, identity or all-sites access sit between the user and every SaaS session. A hijacked extension can lift session tokens after sign-in, so it bypasses passwords and MFA. Measure extension exposure alongside identity metrics, and revoke sessions, not just passwords, after an extension incident. See the Browser Storage Security Guide.

Metrics to track internally

• Extension coverage: share of managed browsers reporting their extension list to central management, with a target near 100%.
• Unique extension IDs: total and per 100 users, tracked monthly; falling counts show allowlisting is working.
• High-risk permission share: share of users with an extension holding cookies, all-sites or scripting access, compared with LayerX's 53% baseline.
• Sideloaded share: extensions not from an official store, compared with LayerX's 26%.
• Time to remove: hours from a public malicious-extension disclosure to the ID being blocked fleet-wide.
• Stale extension share: allowed extensions with no update in 12 months.

Common failure patterns when using extension statistics

• Reading "less than 1%" as low risk: Google's figure is a share of installs across billions of installs; it says nothing about the extensions your staff choose.
• Summing campaign user counts: install counts overlap across campaigns and researchers counted at different times; the Cyberhaven campaign alone has counts of 16, 29 and 35 extensions.
• Treating vendor telemetry as a census: LayerX's enterprise figures come from its own customers. Quote them with that attribution.
• Counting installs as victims: an install count is users who had the extension, not users who had data stolen.
• Assuming store removal fixes it: the GitLab case shows removed extensions stay installed until uninstalled or blocked by policy.
• Citing roundup pages: secondary statistics sites often drop the year and scope. Cite the publisher, as this page does.

Choosing the right source

Methodology notes and caveats

• Google: share of 2024 installs from the Chrome Web Store found to include malware; no extension count given.
• Stanford and CISPA: analysis of Chrome Web Store data over several years; "security-noteworthy" combines malware, policy violations and vulnerabilities.
• LayerX: public store data overlaid with telemetry from its enterprise customers; the report itself has minor inconsistencies (52% and 53% for users with more than ten extensions).
• Campaign counts: taken from the researchers' disclosures as reported; counts change as more extensions are found.

Practitioner checklist

• Cite each figure with publisher, report name and year in the same sentence.
• Collect the extension inventory from every managed browser before setting policy.
• Block extensions by default and allow a reviewed list by extension ID.
• Flag extensions requesting cookies, identity, scripting or all-sites access for deeper review.
• Block sideloading and non-official stores through browser policy.
• Alert on new outbound domains contacted by allowed extensions after updates.
• Remove extensions with no update in 12 months unless an owner justifies them.
• Recheck this page's campaign figures after each major disclosure.

Standards and references

• Google Security Blog: Staying safe with Chrome extensions
• arXiv: What is in the Chrome Web Store? Investigating Security-Noteworthy Browser Extensions
• LayerX: Enterprise Browser Extension Security Report 2025
• MITRE ATT&CK: T1176.001 Browser Extensions
• Techzine: Malicious extensions in Chrome Web Store affected 3.2 million users
• The Register: Massive browser hijacking campaign infects 2.3M Chrome, Edge users
• The Register: Stealthy browser extensions infected 4.3M Chrome, Edge users

Related NHI Mgmt Group resources: Browser Extension Security Guide · Malicious Browser Extension Incident Playbook · Chrome Manifest V3 Transition · Malware Statistics