Chrome Web Store's Shady Extension Problem

Ars Technica reports on the growing spam and scam problem in Google’s Chrome Web Store, where shady browser extensions flood search results with SEO tricks and deceptive names. Many of these extensions mimic legitimate tools while harvesting data, injecting ads, or redirecting traffic, yet often remain listed for weeks or months. Wladimir Palant showed one trick behind the rankings: the store uses a single search index for all languages, so extensions stuff keywords and competitors’ names into fake “translations” few people will ever read, and he counted 920 of them. In a follow-up on the store’s moderation, he found 96 of 108 extensions from a spam cluster reported back in 2023 still listed, while Google rarely tells reporters what, if anything, it did about their reports. Google’s automated moderation systems are struggling to keep up with the volume and tactics. Much like the issues on npm and PyPI, it reflects a broader ecosystem problem: the incentives to ship fast often outweigh the costs of abuse.