Trusted Chrome extensions silently change owners and turn malicious with no user warning
When Chrome extension developers sell or transfer their extensions, the new owner can push a malicious update to all existing users with zero notification. The Chrome Web Store has no ownership-continuity hash and no native alert for ownership changes. A March 2024 HN thread on the 'Under New Management' tool (783 pts) revealed that 14.7% of extensions with 100K+ users have changed owners. Real example: AllBlock changed from allblock@proton.me to woof@curlydoggo.com on December 14, 2024 and immediately started harvesting clickstream data. Trust Wallet's December 2025 supply chain attack drained $8.5M from 2,520 wallets via a compromised extension update. A GitHub tool (634 stars) was built specifically to detect owner changes, proving no native solution exists.
A browser extension that alerts users when installed extensions change ownership, permissions, or code silently
1.5k ▲Score Breakdown
Social Proof 2 sources
Existing Solutions 2 competitors
Chrome extension that alerts users when other installed extensions change their developer/publisher info.
Enterprise product that risk-scores Chrome extensions and integrates with Chrome for Enterprise.
Gap Assessment
Under New Management (GitHub, 634 stars) alerts on owner changes but is a manual check bandaid, not a proactive defense. LayerX provides enterprise extension risk scoring but is not a consumer product. No tool actively verifies that the entity maintaining your extension today is the same entity that built it.