Malicious Chrome Extensions Bypass Remote Code Ban

A recent investigation revealed numerous malicious Chrome extensions circumventing Google's ban on remote code execution. Developed primarily by Phoenix Invicta Inc., Technosense Media Pvt. Ltd., and Sweet VPN, these extensions employ stealthy configurations, obfuscated code, and abuse of the declarativeNetRequest API to inject ads, steal user data, and perpetrate affiliate fraud. The researchers identified dozens of affected extensions, highlighting Google's insufficient oversight of these malicious activities.