287 Chrome extensions leak the browsing history of 37 million users

The Q Continuum group built an automated scanning pipeline that runs Chrome inside Docker, routes all traffic through a MITM proxy, and correlates outbound request sizes with URL lengths to catch extensions phoning home. Their research identified 287 Chrome extensions exfiltrating browsing history from roughly 37.4 million users, about 1% of the global Chrome user base. Data brokers like Similarweb, Chinese actors, and a mysterious outfit called “Big Star Labs” are all happily collecting this data using obfuscation ranging from ROT47 encoding to AES-256 encryption. Similarweb is a familiar name here: back in 2018, Robert Heaton showed that the Stylish theme extension, by then owned by Similarweb, sent every full URL its users visited to its servers along with a unique identifier.