A malicious browser extension is a browser add-on built to steal data, alter page behavior, or hijack authenticated sessions. Unlike a normal extension, it abuses the same permissions that make browser add-ons useful, such as access to tabs, cookies, clipboard content, form fields, or page scripts.
This matters because modern work happens in the browser, so an extension can quietly capture credentials, session tokens, keystrokes, and copied text without looking like traditional malware. Attackers use these implants to stay hidden after initial access, especially in phishing or exploit chains where they want browser-based email, identity, or collaboration accounts. Defenders reduce the risk by allowing only trusted extensions, reviewing permissions, monitoring unusual extension installs or updates, and checking for suspicious script injection or session theft behavior.