Spy in the open tab: free browser extensions are a corporate security nightmare

By Stephanos Spyrou Picture a fairly ordinary Tuesday. Someone in your office is fighting a PDF that will not convert, or a clause that needs translating before a call in twenty minutes. They search, find a free browser extension with a cheerful icon and a few thousand reviews, and click “Add to Chrome.” No password prompt appears. No red warning from IT. The whole thing takes four seconds, and because nothing scary happened on screen, the brain quietly files it under harmless. You have probably done this yourself. I would put money on it. That instinct is not stupid, either, it is just about twenty years out of date, and it is worth five minutes of your time to understand why. Corporate security was built to guard a perimeter: firewalls, network rules, a wall around the office with a well-watched gate. The trouble is that nobody works behind that wall any more. The moment you log into your corporate email or cloud drive through single sign-on, you are already standing inside the building, badge in hand. A browser extension does not need to break in. It simply asks for permission, and most people click accept without reading what they just granted. Excessive extension permissions are the quiet villain here: broad host access lets an extension inherit your exact identity and session, reading what you read, capturing what you type, and helping itself to the cookies keeping you logged in. Some go further and scrape data directly out of the page’s Document Object Model, the underlying structure of everything visible on screen. That is DOM scraping, and it means anything typed into a form field, a client portal, or a chat window can be lifted in real time, no file transfer required, nothing your antivirus was ever built to catch. From the network’s point of view, none of this looks like an intrusion. It looks like Tuesday. It rarely announces itself either. Most of these extensions work exactly as advertised for months. They earn genuine five star reviews and a loyal little user base, because building trust is the whole strategy. Then, without warning, they turn. Security researchers spent early 2026 unpicking one such sprawl: more than 300 Chrome extensions, over 37 million downloads between them, caught siphoning off browsing history and personal data behind entirely convincing exteriors. In June, Microsoft went further and dismantled a campaign it named StegoAd, 119 extensions, up to 2.6 million users, promising ordinary things like ad blockers, calculators, and PDF tools. The malicious code was hidden inside the extensions’ own icon images, invisible to the eye and to most scanners, and it woke up on a delay specifically so early reviewers would only ever see the friendly version. Once active, it harvested login credentials and session cookies well enough to hijack an account without ever touching a password, textbook session hijacking and cookie harvesting carried out by something that looked, to every scanner checking it, like a perfectly innocent calculator. None of this required tricking anyone into visiting a dodgy website. Researchers at the University of Surrey analysed 21,000 real Chrome extensions and found that roughly one in six, collectively used by more than 600 million people, begin third-party tracking within sixty seconds of installation, often without a word of it in the privacy policy anyone actually reads. A written policy telling your staff not to install unapproved extensions will not fix this, for the same reason diets rarely survive the office biscuit tin. This is shadow IT in its purest form, and the convenience trap at its core is simple: nobody installs a translation tool intending to cause a breach, they just want the clause translated before the call starts in ten minutes. Convenience wins in the moment, every time, and the moment is all it takes. What actually closes the gap is browser-level technical governance: treating the browser itself as part of the network worth defending, not the app people happen to use to reach it. That starts with zero-trust workflow mapping, tracing exactly where sensitive data flows once it leaves a secure system and into a browser tab, putting visibility and control at the exact point where someone is about to paste something sensitive, rather than in a PDF policy nobody has opened since induction day. Cyprus is busy positioning itself as a serious, trusted base for international business and technology firms. That reputation will not be won by firewalls alone. It will be won by firms that have already extended good governance all the way down to the browser tab, so that when a client asks how their data is actually protected, the honest answer is not a hope. It is an architecture.