Google, Firefox Browser Extensions Expose Data of 4 Million People
Experts say consumers should be cautious in downloading browser extensions, and delete ones they no longer need
Eight widely used browser extensions have been caught harvesting data from an estimated 4 million consumers who use the web browsers Chrome and Firefox.
The extensions collected a host of information that wasn’t authorized by either browser, exposing not only complete browsing histories but also access to files such as tax returns, medical records, credit card information, and other highly sensitive data, according to a report by Sam Jadali, an independent researcher who discovered the problem.
This data was then shared with the data broker Nacho Analytics, where it could be purchased for as little as $10 to $50, according to Jadali, whose report was first described in Ars Technica.
“I didn’t believe it at first,” Jadali says. He was able to see such sensitive information as people’s medical prescriptions, personal financial data, and travel itineraries.
Browser extensions—also known as plug-ins or add-ons—are small apps that consumers can install to run alongside their browser for additional functionality.
According to Jadali, the extensions included apps with hundreds of thousands to millions of users, including FairShare Unlock, HoverZoom, and SpeakIt, along with some extensions with just a handful of users. His report, titled DataSpii, has the full list.
All the extensions have been remotely removed from or disabled in consumers’ browsers and are no longer available for download, according to representatives from Google and Mozilla, the organization that operates Firefox. Both companies say the practices described in Jadali’s report violate their policies.
No other browsers were apparently affected, Jadali says.
How to Protect Yourself
The eight extensions Jadali reviewed may no longer pose a threat, but security experts say it’s a good idea to review all your browser extensions. “The burden is on consumers to ensure their extensions aren’t putting them at risk,” Oppenheim says. “If you have any extensions or apps that you don’t use and aren’t getting real value out of, uninstall them immediately.”
There may be extensions you can’t part with. Oppenheim recommends that consumers deal only with apps developed by companies that you trust and are familiar with. (Consumer Reports offers its own browser extension, which shows CR ratings and recommendations to members when they shop on certain retail sites.)
Mozilla maintains a list of recommended extensions.
Here’s how to delete browser extensions you’ve installed in the past. These instructions are for a computer, but the steps are similar on a smartphone.
To remove extensions in Chrome: Click the three dots in the top right corner > More Tools > Extensions > Click “Remove” on any extension you want to delete > Remove.
To remove extensions in Firefox: Click the menu with three horizontal lines in the top right corner > Add-ons > Extensions > Click “Remove” on any extension you want to delete.
To remove extensions in Safari: Click “Safari” from the menu bar at the top of your screen > Preferences > Extensions > Click “Uninstall” on any extension you want to delete.
To remove extensions in Internet Explorer: Click the three dots in the top right corner > Extensions > Click the gear icon next to any extension you want to delete > Uninstall > OK.