In summary:
- PCWorld reports on a new Chrome extension called ‘Under New Management’ that alerts users when their installed extensions change developers or ownership.
- This security tool addresses the growing problem of popular Chrome extensions being sold and then stealth-updated with malicious code to hijack web traffic.
- Developer Matt Frisbie made the extension’s code publicly available on GitHub, helping users without coding skills protect themselves from compromised browser extensions.
Yesterday, I reported on a Chrome extension, which I’d personally been using for years, that (presumably) got sold off and started hijacking my web traffic. I lamented that Google seems particularly susceptible to this trick, where a popular extension switches ownership and is stealth-updated to bypass protections on the Chrome Web Store. At least one extension is trying to solve that issue.
“Under New Management” by ClassVSoftware regularly checks the extensions you currently have installed and alerts you when one of them changes developer information on the Chrome Web Store. (This should work with other Chromium-based browsers, like Vivaldi, which also removed the offending extension from yesterday after Google shut it down.) A flashing button will show you which extension has been affected and what values have changed.
“But Michael,” I hear a hypothetical and highly convenient reader say, “what’s to stop this extension from simply pulling the same trick? What if this one is sold off to a bad actor once it gets popular and becomes compromised itself?” Oh, I’m glad you asked.
For one, the developer appears to be a singular person named Matt Frisbie, according to the website. Given the nature of the extension and the number of users—9,000 at the time of writing—it doesn’t seem like Under New Management is in danger of being targeted for the same bait-and-switch, at least not yet. Some of the extensions that were previously affected had more than a million downloads.
Perhaps more importantly, Frisbie has published the code of the extension to GitHub. Anyone with coding chops can compare the version of the extension on the Chrome Web Store with the published code to make sure there’s no hanky-panky going on.
As yesterday demonstrated, installing any software on your browser (or PC, or phone, or game console, or smart toaster) has a degree of risk—and that object lesson has me suddenly gun-shy about recommending browser extensions. But this one seems like a good way for less code-savvy users to get at least a small degree of comfort.
Author: Michael Crider, Staff Writer, PCWorld
Michael is a 15-year veteran of technology journalism, covering everything from Apple to ZTE. On PCWorld he's the resident keyboard nut, always using a new one for a review and building a new mechanical board or expanding his desktop "battlestation" in his off hours. Michael's previous bylines include Android Police, Digital Trends, Wired, Lifehacker, and How-To Geek, and he's covered events like CES and Mobile World Congress live. Michael lives in Pennsylvania where he's always looking forward to his next kayaking trip.