Interactive Troubleshooter

Published: Sep 18, 2026

Browser Extensions Stealing Data: Audit and Remove

Time: 15 mins Level: Beginner

By StepDiag Engineering Team

Reviewed by Ibraheem Taofeeq Opeyemi

An exhaustive root-cause diagnostic tree for identifying, isolating, and removing malicious browser extensions. Resolves enterprise forced-policy installation, DOM input keylogging, session cookie exfiltration, and local malware persistence droppers.

Full Diagnostic Tree & Step-by-Step Overview

What specific symptom or anomalous behavior indicates extension data exfiltration or browser tampering?

Unrecognized extension installed, grayed out, or locked by 'Managed by your organization'.
Browser search engine hijacked, unexpected ads injected into web pages, or URLs redirecting.
Account session takeover, credential theft, keystroke logging, or clipboard address swapping.
Extension re-installs automatically after deletion, system reboot, or browser profile reset.

Which method or policy mechanism is enforcing the persistent extension installation?

Extension enforced via Windows Registry or Group Policy (ExtensionInstallForcelist).
Unpacked or sideloaded extension running directly via Developer Mode flags.
Extension automatically re-downloads across devices via Browser Profile Cloud Sync.
macOS Configuration Profiles (.mobileconfig) forcing Safari or Chrome extensions.

Purging Windows Registry Policy Locks (ExtensionInstallForcelist)

Solution:

Root Cause: Registry Policy Injection (ExtensionInstallForcelist)

Malware with elevated privileges writes to system registry policy keys (HKLM\SOFTWARE\Policies\Google\Chrome\ExtensionInstallForcelist or HKLM\SOFTWARE\Policies\Microsoft\Edge\ExtensionInstallForcelist). This marks the extension as enterprise-managed, disabling the standard GUI 'Remove' button.

# Diagnostic Verification:

1. Navigate to chrome://policy or edge://policy in your browser address bar.
2. Locate policies named ExtensionInstallForcelist or ExtensionInstallAllowlist and note the extension ID string.
3. Open PowerShell as Administrator and check for the registry keys:

powershell
Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Google\Chrome\ExtensionInstallForcelist" -ErrorAction SilentlyContinue
Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Edge\ExtensionInstallForcelist" -ErrorAction SilentlyContinue

# Step-by-Step Fix:

1. Force terminate all browser instances:

powershell
Stop-Process -Name "chrome", "msedge", "brave" -Force -ErrorAction SilentlyContinue

2. Delete malicious policy keys from HKLM and HKCU registry hives:

powershell
Remove-Item -Path "HKLM:\SOFTWARE\Policies\Google\Chrome" -Recurse -Force -ErrorAction SilentlyContinue
Remove-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\Edge" -Recurse -Force -ErrorAction SilentlyContinue
Remove-Item -Path "HKCU:\SOFTWARE\Policies\Google\Chrome" -Recurse -Force -ErrorAction SilentlyContinue
Remove-Item -Path "HKCU:\SOFTWARE\Policies\Microsoft\Edge" -Recurse -Force -ErrorAction SilentlyContinue

3. Purge local Group Policy cache directories:

powershell
Remove-Item -Path "C:\Windows\System32\GroupPolicy\Machine\registry.pol" -Force -ErrorAction SilentlyContinue
Remove-Item -Path "C:\Windows\System32\GroupPolicyUsers\*" -Recurse -Force -ErrorAction SilentlyContinue

4. Force Group Policy refresh in Command Prompt:

cmd
gpupdate /force

5. Delete extension files from disk (%LocalAppData%\Google\Chrome\User Data\Default\Extensions\<EXTENSION_ID>).

# Prevention & Long-Term Monitoring:

Enforce Windows Defender Application Control (WDAC) or AppLocker rules to block unauthorized registry modifications to policy paths. Consult Google Chrome Enterprise Documentation for policy compliance guidelines.

Removing Sideloaded / Unpacked Developer Mode Extensions

Solution:

Root Cause: Unpacked Extension Sideloading

An attacker dropped an unverified extension folder onto local storage and modified browser launch shortcuts to append command-line arguments like --load-extension="C:\Path\To\Malware" or enabled Developer Mode silently.

# Diagnostic Verification:

1. Open chrome://extensions or edge://extensions.
2. Enable Developer mode toggle in the top-right corner.
3. Locate extensions labeled Source: Unpacked extension or Loaded from: [Local Path].

# Step-by-Step Fix:

1. Note the exact file path listed under Loaded from.
2. Click Remove on the extension card in chrome://extensions.
3. Open PowerShell and permanently purge the target extension folder:

powershell
Remove-Item -Path "C:\Path\To\UnpackedExtensionFolder" -Recurse -Force

4. Audit all desktop and taskbar shortcuts for binary argument hijacking:

powershell
Get-CimInstance Win32_ShortcutFile | Where-Object { $_.Target -match "chrome.exe|msedge.exe" -and $_.Arguments -match "load-extension" } | Select-Object Name, Arguments

5. Right-click browser shortcuts, open Properties, and delete any extraneous paths appended after chrome.exe" in the Target field.

# Prevention & Long-Term Monitoring:

Disable Developer Mode globally via enterprise policy setting DeveloperToolsAvailability (Value: 2).

Clearing Compromised Browser Cloud Sync Infrastructure

Solution:

Root Cause: Synchronized Extension Persistence

When a malicious extension is installed, browser sync services (Google Account Sync or Microsoft Sync) upload the extension ID and configuration to cloud storage. Deleting it locally triggers cloud resynchronization on browser restart.

# Diagnostic Verification:

Removing an extension manually works temporarily, but the extension reappears within 30 to 60 seconds after launching the browser or logging into the user profile.

# Step-by-Step Fix:

1. Navigate to browser sync settings (chrome://settings/syncSetup/advanced or edge://settings/profiles/sync).
2. Select Customize sync and toggle OFF Extensions.
3. Open Chrome Sync Dashboard (chrome.google.com/sync) or Microsoft Account Privacy Dashboard in an incognito window.
4. Scroll to the bottom and click Clear Data (or Reset Sync) to wipe the cloud sync storage vault.
5. Delete the extension locally from chrome://extensions.
6. Restart the browser, confirm the extension does not return, then re-enable Cloud Sync if desired.

# Prevention & Long-Term Monitoring:

Require Multi-Factor Authentication (MFA) on browser account sign-ins to prevent unauthorized profile syncing across external endpoints.

Removing macOS System Configuration Profiles (.mobileconfig)

Solution:

Root Cause: macOS Managed Preference Profile Injection

Mac adware installers drop unsigned .mobileconfig payload profiles into /Library/Managed Preferences/, forcing Safari or Chrome to maintain persistent malicious extensions and homepages.

# Diagnostic Verification:

1. Open macOS System Settings -> Privacy & Security -> Scroll down to Profiles.
2. Open Terminal (/Applications/Utilities/Terminal.app) and list installed configuration profiles:

bash
sudo profiles show -active

# Step-by-Step Fix:

1. In Terminal, identify the payload identifier corresponding to the suspicious profile.
2. Remove the managed profile using administrative rights:

bash
sudo profiles remove -identifier <ProfileIdentifier>

3. Delete profile preference files from local directories:

bash
sudo rm -rf /Library/Profiles/
sudo rm -rf ~/Library/Profiles/
sudo rm -rf /Library/Managed\ Preferences/

4. Remove Safari extension artifacts:

bash
rm -rf ~/Library/Containers/com.apple.Safari/Data/Library/Preferences/com.apple.Safari.Extensions.plist

5. Restart the Mac and launch Safari/Chrome to confirm removal.

# Prevention & Long-Term Monitoring:

Enable macOS Gatekeeper and restrict profile installation permissions using Apple Mobile Device Management (MDM) solutions.

Which runtime DOM injection or network redirection behavior are you observing?

Content scripts injecting malicious ads, popups, or iFrames into web pages.
Omnibox search queries redirecting through unauthorized search tracking engines.
Dynamic link modifying and affiliate code hijacking on e-commerce sites.
Browser traffic routed through a malicious Proxy Auto-Config (PAC) script.

Isolating Content Script Injections and DOM Tampering

Solution:

Root Cause: Overly Permissive Manifest Content Scripts

The extension uses Manifest v2/v3 content scripts declared with <all_urls> match patterns. This allows background scripts to execute arbitrary JavaScript (document.createElement('script')) on every loaded web page to inject ads or external iFrames.

# Diagnostic Verification:

1. Open Chrome Task Manager using Shift + Esc.
2. Inspect CPU, Memory, and Network columns for extensions generating high continuous activity.
3. Press F12 on an affected web page -> Go to Sources tab -> Expand Content scripts side panel to view script origins.

# Step-by-Step Fix:

1. Open chrome://extensions and locate the offending extension.
2. Click Details -> Scroll to Site permissions.
3. Change permission setting from On all sites to On click or On specific sites.
4. Audit running background service workers via chrome://serviceworker-internals.
5. Click Unregister on any service worker tied to the extension ID.
6. Uninstall the extension completely.

# Prevention & Long-Term Monitoring:

Audit extension permission requests upon installation; avoid tools demanding 'Read and change all your data on all websites'.

Remediating Search Engine Omnibox Hijackers

Solution:

Root Cause: Manifest chrome_settings_overrides Exploitation

The extension modifies browser search parameters via the chrome_settings_overrides API object. This intercepts address bar (Omnibox) queries and routes them through intermediary tracking endpoints to earn ad revenue.

# Diagnostic Verification:

1. Navigate to chrome://settings/searchEngines or edge://settings/searchEngines.
2. Inspect the Default search engine section for entries marked 'Enforced by an extension'.
3. Note the extension ID attached to the search engine definition.

# Step-by-Step Fix:

1. Open chrome://extensions and locate the matching extension ID.
2. Click Remove and confirm deletion.
3. Return to chrome://settings/searchEngines, click the three dots next to the hijacked search engine, and select Delete.
4. Set your preferred search engine (e.g., Google, DuckDuckGo) as default.
5. Reset browser settings to purge residual flags (chrome://settings/reset -> Restore settings to their original defaults).

# Prevention & Long-Term Monitoring:

Lock default search engine choices via Enterprise Policy setting DefaultSearchProviderEnabled.

Mitigating Affiliate Link Hijacking and Dynamic URL Rewriting

Solution:

Root Cause: DeclarativeNetRequest / WebRequest API Manipulation

The extension uses declarativeNetRequest or background webRequest event listeners to parse outbound HTTP requests. It injects affiliate tracking tags (?tag=, ?aff_id=) or rewrites dynamic href elements in the DOM.

# Diagnostic Verification:

1. Open Developer Tools (F12) -> Select Network tab -> Check Preserve log.
2. Click a standard product link on an e-commerce page.
3. Inspect the HTTP 302/307 redirects in the Network panel to detect chrome-extension://<EXTENSION_ID>/ initiating the request sequence.

# Step-by-Step Fix:

1. Identify the initiator extension ID from the Network waterfall trace.
2. Open chrome://extensions and remove the target extension.
3. Clear browser HTTP cache and cookies (Ctrl + Shift + Delete -> Select All time -> Check Cached images and files).
4. Purge local extension storage directories in PowerShell:

powershell
Remove-Item -Path "$env:LOCALAPPDATA\Google\Chrome\User Data\Default\Local Extension Settings\<EXTENSION_ID>" -Recurse -Force -ErrorAction SilentlyContinue

# Prevention & Long-Term Monitoring:

Avoid installing untrusted coupon, price-comparison, or cashback extensions that require global network request permissions.

Purging Malicious Proxy Auto-Config (PAC) Extensions

Solution:

Root Cause: chrome.proxy API Traffic Redirection

The extension invokes the chrome.proxy API to configure custom proxy settings, forcing all browser HTTPS traffic through a rogue Proxy Auto-Config (PAC) script (pac+http://...) for Man-in-the-Middle (MitM) inspection.

# Diagnostic Verification:

1. Navigate to chrome://net-internals/#proxy or edge://net-internals/#proxy.
2. Review Effective proxy settings for external PAC script URLs or unauthorized SOCKS/HTTP proxy addresses.

# Step-by-Step Fix:

1. Locate the extension enforcing proxy settings in chrome://extensions and click Remove.
2. Open Windows Proxy Settings (Win + I -> Network & internet -> Proxy).
3. Toggle OFF Use setup script and Use a proxy server.
4. Flush system DNS cache in PowerShell:

powershell
Clear-DnsClientCache

5. Verify proxy settings in net-internals return to Direct connections.

# Prevention & Long-Term Monitoring:

Enforce system proxy policies via GPO (ProxySettings) to prevent extensions from altering network routing.

What type of data exfiltration or credential theft vector was detected?

Extension hooking DOM input events to keylog passwords and form data.
Extension reading and transmitting session cookies via chrome.cookies API.
Clipboard manipulation hijacking cryptocurrency wallet addresses or copied text.
Rogue overlay forms injecting fake login fields into legitimate websites.

Remediating DOM Keylogging and Input Event Listeners

Solution:

Root Cause: DOM Event Listener Key Sniffing

Content scripts attach global event listeners (addEventListener('keydown') or addEventListener('input')) to the DOM. Keystrokes typed into input fields are captured, serialized, and sent to an exfiltration Command & Control (C2) server via Fetch/XHR.

# Diagnostic Verification:

1. Open DevTools (F12) on a target login page.
2. Go to Sources tab -> On the right pane, expand Event Listener Breakpoints -> Expand Control -> Check keydown and input.
3. Type into an input box; if execution pauses inside a chrome-extension:// script file, keylogging is active.

# Step-by-Step Fix:

1. Identify the extension ID from the call stack in DevTools.
2. Open chrome://extensions and remove the malicious extension immediately.
3. Disconnect from network temporarily and change all sensitive passwords from a clean secondary device.
4. Revoke active sessions across key accounts (Google, Microsoft, Banking portals) by selecting Sign out everywhere.

# Prevention & Long-Term Monitoring:

Use dedicated password managers with autofill capabilities that populate inputs programmatically without triggering manual DOM keydown events.

Stopping Session Cookie Exfiltration via chrome.cookies API

Solution:

Root Cause: API Cookie Harvesting

The extension requests cookies and <all_urls> host permissions in its manifest.json. Background scripts query chrome.cookies.getAll({}), harvesting session cookies (SID, JSESSIONID, authToken) and exfiltrating them to bypass MFA.

# Diagnostic Verification:

1. Open extension directory: %LocalAppData%\Google\Chrome\User Data\Default\Extensions\<EXTENSION_ID>\.
2. Open manifest.json in a text editor and search for "cookies" under "permissions".

# Step-by-Step Fix:

1. Remove the extension via chrome://extensions.
2. Clear browser session storage and cookies (Ctrl + Shift + Delete -> All time -> Check Cookies and other site data).
3. Invalidate stolen session tokens by performing a global password reset and executing Sign Out All Sessions on critical online accounts.
4. Clear local extension database storage in PowerShell:

powershell
Remove-Item -Path "$env:LOCALAPPDATA\Google\Chrome\User Data\Default\IndexedDB\chrome-extension_*" -Recurse -Force -ErrorAction SilentlyContinue

# Prevention & Long-Term Monitoring:

Restrict extension installations to Web Store items verified by manifest analysis tools, blocking extensions that combine cookies permissions with wide host permissions.

Resolving Clipboard Hijackers and Text Replacement Injections

Solution:

Root Cause: Clipboard API Exploitation

The extension requests clipboardRead and clipboardWrite permissions, or monitors DOM copy and paste events. When a regex match identifies a cryptocurrency wallet address or sensitive key, the extension swaps the string with an attacker-controlled address.

# Diagnostic Verification:

1. Copy a test string or sample crypto wallet address.
2. Paste the content into Notepad (notepad.exe) and check if characters or wallet addresses differ from the copied text.

# Step-by-Step Fix:

1. Open chrome://extensions.
2. Disable installed extensions individually, testing clipboard paste behavior after each toggle to pinpoint the culprit.
3. Click Remove on the offending extension.
4. Delete browser extension cache files in PowerShell:

powershell
Remove-Item -Path "$env:LOCALAPPDATA\Google\Chrome\User Data\Default\Local Extension Settings" -Recurse -Force -ErrorAction SilentlyContinue

5. Restart the computer to clear volatile system clipboard buffers.

# Prevention & Long-Term Monitoring:

Visually verify pasted cryptocurrency wallet addresses character-by-character before confirming outbound transactions.

Eliminating Phishing Form Overlays and HTML Injections

Solution:

Root Cause: Injecting Phishing DOM Elements

Content scripts parse web pages for login containers and inject rogue <div> overlays or alter the <form action="..."> target attribute, sending submitted credentials directly to a remote C2 collector before forwarding to the real site.

# Diagnostic Verification:

1. Right-click on a suspicious login form or button -> Select Inspect.
2. Examine the HTML <form> element tag: verify if the action attribute points to an external unrecognized domain or chrome-extension:// path.

# Step-by-Step Fix:

1. Identify the script source associated with the injected DOM elements in the DevTools Elements panel.
2. Locate and uninstall the extension from chrome://extensions.
3. Change credentials for any account accessed while the overlay was active.
4. Enable Hardware Security Key (FIDO2/WebAuthn) authentication, which binds cryptographic sign-ins strictly to genuine origin domains.

# Prevention & Long-Term Monitoring:

Leverage browsers supporting site isolation policies to segregate content scripts from authentication frames.

Which local system persistence mechanism is re-installing the malicious extension?

Local Windows Scheduled Task or Autorun Registry key dropping extension CRX files.
Trojanized Chromium executable or patched chrome.dll binary side-loading extensions.
Tampered Secure Preferences JSON file bypassing browser hash verification.
Domain Controller Active Directory Group Policy (GPO) enforcing extension deployment.

Eliminating Scheduled Task and Autorun Persistence Droppers

Solution:

Root Cause: Windows System Persistence Dropper

Independent local malware maintains a Scheduled Task or Autorun registry entry. At system startup, this background process re-creates extension files in %LocalAppData% and re-injects registry policy keys.

# Diagnostic Verification:

1. Open PowerShell as Administrator and inspect active scheduled tasks filtering for browser keywords:

powershell
Get-ScheduledTask | Where-Object { $_.TaskPath -match "Chrome|Edge|Extension|AppData" -or $_.Actions.Execute -match "AppData" }

2. Inspect Windows Autorun registry paths:

powershell
Get-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run"
Get-ItemProperty -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run"

# Step-by-Step Fix:

1. Delete malicious scheduled tasks found during inspection:

powershell
Unregister-ScheduledTask -TaskName "MaliciousTaskName" -Confirm:$false

2. Remove persistent startup registry entries:

powershell
Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run" -Name "MaliciousEntryName" -ErrorAction SilentlyContinue

3. Execute a full Microsoft Defender Offline scan to neutralize the core payload binary:

powershell
Start-MpWDOScan

# Prevention & Long-Term Monitoring:

Use Sysinternals Autoruns to audit system startup locations and enable Windows Defender Attack Surface Reduction (ASR) rules.

Remediating Chromium Binary Modification and DLL Side-Loading

Solution:

Root Cause: Corrupted Binary / DLL Hooking

Malware replaces native browser DLL files (e.g., version.dll, winhttp.dll) inside the application directory (C:\Program Files\Google\Chrome\Application\) to intercept execution calls and bypass store verification checks.

# Diagnostic Verification:

1. Check for non-standard DLL files residing inside the Chrome/Edge application folder:

powershell
Get-ChildItem -Path "C:\Program Files\Google\Chrome\Application" -Filter "*.dll" | Where-Object { $_.Name -notmatch "chrome.dll|chrome_elf.dll" }

# Step-by-Step Fix:

1. Force terminate browser processes:

powershell
Stop-Process -Name "chrome", "msedge" -Force -ErrorAction SilentlyContinue

2. Uninstall Chrome or Edge via Windows Settings -> Apps.
3. Completely purge application binaries and user data folders:

powershell
Remove-Item -Path "C:\Program Files\Google\Chrome" -Recurse -Force -ErrorAction SilentlyContinue
Remove-Item -Path "$env:LOCALAPPDATA\Google\Chrome" -Recurse -Force -ErrorAction SilentlyContinue

4. Download a fresh offline installer directly from the official browser website and perform a clean reinstall.

# Prevention & Long-Term Monitoring:

Enable binary signature verification policies to prevent unsigned DLL side-loading inside program directories.

Resetting Tampered Secure Preferences JSON Files

Solution:

Root Cause: Secure Preferences HMAC Hash Tampering

Chromium uses a file named Secure Preferences to track installed extensions and settings using HMAC hashes. Malware directly manipulates this JSON file to insert extensions while attempting to bypass integrity checks.

# Diagnostic Verification:

Launching the browser displays an alert stating: "Settings were reset because an application changed them".

# Step-by-Step Fix:

1. Close all browser windows completely.
2. Open PowerShell and navigate to the user profile directory:

powershell
cd "$env:LOCALAPPDATA\Google\Chrome\User Data\Default"

3. Rename or delete tampered preference files:

powershell
Remove-Item -Path "Secure Preferences" -Force -ErrorAction SilentlyContinue
Remove-Item -Path "Preferences" -Force -ErrorAction SilentlyContinue

4. Relaunch the browser. Chromium will automatically generate clean default preference files.
5. Reconfigure essential user settings and reinstall verified extensions from the official Web Store.

# Prevention & Long-Term Monitoring:

Set directory access permissions to restrict write access to browser preference paths for non-essential processes.

Remediating Active Directory Domain Controller GPO Deployments

Solution:

Root Cause: Active Directory Domain GPO Enforcement

In domain-joined environments, a compromised Domain Controller or rogue Group Policy Object (GPO) enforces ExtensionInstallForcelist across all subnet workstations upon domain logon.

# Diagnostic Verification:

1. Open Command Prompt as Administrator.
2. Generate a Group Policy HTML report:

cmd
gpresult /h C:\gpreport.html

3. Open C:\gpreport.html and search for extension policies under Winning GPO.

# Step-by-Step Fix:

1. On the Domain Controller, launch Group Policy Management (gpmc.msc).
2. Locate the winning GPO identified in the report under Group Policy Objects.
3. Edit the policy under Computer Configuration -> Administrative Templates -> Google -> Google Chrome -> Extensions.
4. Open Configure the list of force-installed apps and extensions, select Disabled or remove the malicious CRX string, and click Apply.
5. On client workstations, execute a forced policy update:

cmd
gpupdate /force

# Prevention & Long-Term Monitoring:

Implement strict Role-Based Access Control (RBAC) on Domain Controllers and enable GPO modification auditing.

Related Diagnostic Guides

Windows Credential Guard Blocking App: Exclusion Guide

USB Drive Shows Shortcut Virus: Remove Without Format

Google Account Suspicious Activity: Device Check

Microsoft Account Hacked: Lockdown and Recovery Steps

Notion Offline Mode Data Lost: Version History & Cache Recovery Guide

Subscribe to StepDiag

Embed Guide on Your Website