The browser extension an employee installs to save a few minutes could be the most exposed point in your entire security posture.
Everyday tools like grammar checkers and PDF converters look harmless, and that is precisely what makes malicious browser extensions so effective. They run inside the browser, reaching company data and logged-in sessions in the space that endpoint security gaps leave unwatched.
In early 2026, security researchers documented one such tool. A browser extension called CrashFix was sitting inside employees’ browsers across multiple businesses, behaving like a beneficial add-on while carrying out malicious activity in the background.
The companies running it had endpoint protection in place. The activity still went unnoticed because it was happening somewhere those tools were never designed to look.
A Helpful Tool That Was Never Helpful
The campaign was analyzed by the security firm Huntress, which tied it to a threat actor it tracks as KongTuke. The entry point was a fake ad blocker.
An employee searching for a way to block ads found a listing in the official Chrome Web Store, which lent the extension an air of legitimacy, and installed it. The extension was a near-identical copy of a well-known, genuine ad blocker, so nothing looked out of place.
Here is the part that answers the obvious question: how could something installed to fix crashes cause any harm? The extension was the crash. It worked in a deliberate sequence:
- After a delay long enough to break the mental link between installing it and any problems, the extension it overwhelmed the browser until it became unresponsive and had to be force-quit.
- On restart, the user was shown an official-looking warning that the browser had “stopped abnormally,” along with an offer to scan and fix the issue.
- Following those steps placed a hidden command on the system and ran it.
The fix was the attack.
Why Endpoint Tools Did Not Catch It
Traditional endpoint protection watches the operating system. It looks for malicious files being written to disk, known-bad programs trying to run, and recognizable patterns of attack. A browser extension lives a level above all of that, inside the browser itself, where it can reach the things employees handle all day:
- The pages a user visits and the data they enter into them
- Active, logged-in sessions for email and business applications
- The cookies that keep those sessions authenticated
None of that requires dropping a suspicious file or launching an obvious program, so the usual alarms stay silent. CrashFix also took deliberate steps to stay quiet.
It waited before acting and quietly checked which security products were installed. The final command was left for the user to run by hand, so the activity looked like an ordinary person using their own computer.
By the time anything looked wrong, the extension had already been reporting back to its operators.
This is not a one-off. In fact, recent industry analysis of more than one million enterprise devices found that around 10.8% of installed browser extensions carry a known vulnerability with an assigned Common Vulnerabilities and Exposures, and most organizations have no formal way to track what their staff install.
What This Means for Your Business
Consider how this plays out inside an organization. An employee installs what looks like a useful tool, with no warning sign that anything is wrong. The attacker now holds a position inside the browser, which can mean access to:
- Stored credentials saved in the browser
- Live sessions the employee is already logged in to
- Sensitive information that passes through web applications during the working day
CrashFix was built with corporate machines in mind, reserving its most capable payload for company-managed devices, where a single foothold can open the door to internal systems and wider access.
The broader point is that browser-based threats are growing precisely because they fall into a gap. Endpoint tools cover the operating system. Employees spend their day in the browser.
The space in between is where this class of attack operates, and most security setups were never built to watch it. As more work moves into web apps and AI tools that run as extensions, that gap keeps widening, and closing it has become a core part of modern IT consulting.
Closing the Gap
Closing these gaps takes three things working together:
- Visibility into the browser layer, so that extensions and their behavior are actively monitored rather than assumed safe.
- A clear policy on what employees can install so that one risky add-on cannot quietly grant access to sensitive data.
- A security partner watching for emerging threats, adjusting defenses as attackers change tactics rather than relying only on tools that catch what they were originally built to catch.
Each of these is achievable with the right support, and together they turn the browser into a part of your environment you can actually account for.
Talk to Anderson Technologies About Browser Security
At Anderson Technologies, we take a proactive approach to cybersecurity, keeping watch on the parts of your environment that conventional tools overlook.
If you are not certain what is running inside your team’s browsers or who would notice if something like CrashFix turned up, we work with your leadership team to put the right protections in place.
Schedule a consultation with Anderson Technologies to review where your current protection ends, where the gaps begin, and how to close them.
FAQs
- What are malicious browser extensions?
Malicious browser extensions are add-ons that look like useful tools while quietly stealing data or running harmful code from inside the browser. - How do malicious browser extensions get past endpoint security?
They run inside the browser, a layer above where endpoint tools look, so their activity avoids the usual alerts. This is a common example of endpoint security gaps. - Can browser extensions steal passwords or session data?
Extensions with broad permissions can reach cookies, saved credentials, and active sessions, which is why browser security for business matters. - How can businesses improve browser security?
Track which extensions are installed, set a policy on what employees can add, and monitor for emerging browser-based threats with a security partner. - Why are endpoint security gaps a growing concern in 2026?
The attack surface has moved into the browser, and malicious browser extensions exploit the space traditional endpoint protection was never built to watch.