Google bans two extensions from Chrome store that sent malware

Google has removed two extensions for its Chrome Web browser after they began delivering malware to their users. The malicious ads began displaying after the extensions were purchased from their original developers.

Users of Google Chrome can modify their experience with so-called extensions, which are essentially apps for the Web browser.

The extensions that were recently banned, Add to Feedly and Tweet This Page, had modest followings of several thousand users, but they were recently purchased. The new owners took advantage of a Chrome feature that allows developers to update their extensions without notifying users -- the updates added malware ads to the extensions.

"These aren’t regular banner ads that you see on web pages, these are invisible ads that work the background and replace links on every website that you visit into affiliate links," said Amit Agarwal, Add to Feedly's original developer, in a blog. "In simple English, if the extension is activated in Chrome, it will inject adware into all web pages."

Agarwal said he decided to sell his software after being offered a four-figure sum. About a month after selling it, he said Add to Feedly began delivering the malware.

"It was probably a bad idea to sell the Chrome add-on and am sorry if you were an existing user," he said.

Add to Feedly and Tweet This Page are likely not the only Chrome extensions that have been purchased from their original owners so that they can be used to deliver malware. The developers of Honey, another Chrome extension, said they have been approached for similar reasons.

"Over the past year we've been approached by malware companies that have tried to buy the extension, data collection companies that have tried to buy user data, and adware companies that have tried to partner with us," the developers said.

:story: LA Times