Chrome extensions with 1.4M installs covertly track visits and inject code

The extensions sent the name of each site visited to the developer-designated site [...], along with a unique identifier and the country, city, and zip code of the visiting device. If the site visited matched a list of ecommerce sites, the developer domain instructed the extensions to insert JavaScript into the visited page. The code modified the cookies for the site so that the extension authors receive affiliate payment for any items purchased.

Click to expand...