The not-so-dirty secret about web browsers is that browser extensions can be a major security weakness. But the problem with extensions deserves further treatment, especially as they can combine some very clever supply chain and obfuscation methods to make these kinds of attacks harder to detect and defend. These extensions are powerful tools: they have the same ability as your user account to obtain read/write access to any data in any browsing session you bring up, which makes exploiting them a big issue. Many extensions don’t require any special permissions to run on your computer or phone.

I write about how extensions can be exploited and what you can do to protect yourself in my latest post for Avast’s blog here.