Chrome’s August 1 deadline: a privacy reset for extensions
Google’s new Chrome extension privacy rules are a set of enforcement policies that limit extension data collection, demand clearer disclosures from developers, and ban certain high‑risk extension types so that Chrome users have tighter control over what add‑ons do inside their browsers. This move is not a minor policy tweak; it is a hard reset for the Chrome Web Store. Developers have until August 1 to meet stricter privacy requirements or see their extensions removed from the store. In plain terms, Google is finally admitting that the extension ecosystem has become a liability and is using policy, not only code, to clean it up. The message to users is blunt: your browser’s safety now depends on which extensions you keep, not just on Chrome’s version number.
Under the revised Limited Use Policy, any data collected must be strictly necessary for the extension’s disclosed single purpose, and collecting user data beyond that purpose is prohibited. Google has also made it clear that if an extension asks for or gathers data that isn’t directly related to its purpose, that alone is considered a policy violation. Extensions designed to bypass safety restrictions on AI services will no longer be allowed, and those that facilitate real‑money prediction market bets are now explicitly banned from the Chrome Web Store. Google will start enforcing these rules on August 1, and non‑compliant extensions risk removal.
Manifest V3 didn’t stop abuse—and Microsoft proved it
If you thought Manifest V3 made malicious browser extensions a solved problem, Microsoft’s latest findings should change your mind. Microsoft’s Defender Security Research team identified a malicious Chromium extension disguised as a Perplexity AI search tool that abused Manifest V3 capabilities to intercept users’ browser searches while quietly forwarding them to legitimate search engines. This was not a lab demo; it was an active attack that lived in the same ecosystem Google calls safer.
The extension configured itself as the default search provider and overrode Chrome’s search suggestions so that every character typed into the address bar could be transmitted to the attackers’ servers before users even pressed Enter. Its infrastructure logged search queries, browser details, HTTP headers, and IP addresses, turning a supposed AI helper into a silent data collection tool. Interestingly, it relied heavily on Manifest V3’s Declarative Net Request APIs, using them to route searches through attacker‑controlled infrastructure before redirecting to real services like Perplexity, Google, or Bing. Google has removed the extension from the Chrome Web Store following responsible disclosure, but the lesson is harsh: upgrading the extension framework raises the bar, yet determined attackers can still twist legitimate APIs into surveillance tools.
What the new rules target: data grabs, stealth changes, and AI jailbreaks
Google’s crackdown focuses on a pattern that has repeated across malicious browser extensions this year: over‑collection of data, undisclosed behavioral shifts after installation, and tools that try to outsmart AI safeguards. Chrome Web Store enforcement will now treat extension data collection as guilty until proven necessary. If a notes add‑on wants full clipboard access or a wallpaper pack wants to track you across sites, it has to justify that access and disclose it prominently—or disappear from the store.
Recent incidents show why this tightening is overdue. Two extensions advertised as free VPNs for Chrome and Firefox worked as expected at first, but a later update started reading users’ clipboard contents, including passwords and cryptocurrency wallet addresses, while their listings still claimed they collected no user data. A fake "Google Notes" extension replaced copied cryptocurrency wallet addresses with one controlled by an attacker, and more than 150 wallpaper extensions tracked users while falsely claiming they didn’t collect any information. Against that backdrop, Google is expanding disclosure requirements so developers must inform users about all data collection, and they must proactively disclose any changes in data handling after installation. Extensions built to bypass AI safety guardrails or enable real‑money prediction markets are also now banned.
Audit your extensions: how to respond to Chrome Web Store enforcement
The August 1 enforcement wave is not just a developer story; it is a user security advisory. Malicious browser extensions have already shown they can hijack searches, read clipboards, and tamper with cryptocurrency transactions, all while pretending to be helpful tools. Browser vendors and security teams now agree that the extension list is one of the most sensitive surfaces on any device. As Google tightens Chrome Web Store enforcement, the safest stance for users is active skepticism: assume every extension is a potential data broker until its behavior proves otherwise.
Microsoft’s researchers recommend installing browser extensions only from trusted publishers, verifying official domains before downloading AI‑themed tools, and paying close attention to requested permissions, especially those involving search settings or network traffic. Combined with Google’s new policies—which require that data collection be strictly necessary, fully disclosed, and not repurposed beyond a single stated use—this gives users a practical filter: if an extension’s permissions, description, and behavior do not line up, treat that as a red flag and act accordingly. The extension ecosystem is being forced to grow up; your browser will be safer only if your add‑on habits grow up with it.
