Flawed Chrome extension forcibly installed by AVG antivirus software could have exposed browsing history and other personal data of 9M+ users
AVG's Chrome extension exposes personal data of 9 million users — Google Project Zero researcher Tavis Ormandy discovered a vulnerability …
Context & Ripple Effects
The AVG incident is an early entry in what has become a recurring genre: security software itself becoming the leak vector. Google Project Zero's Tavis Ormandy found that an extension AVG force-installed alongside its antivirus exposed browsing history and other personal data for over 9 million users; per follow-up coverage, it was patched within a day.
The arc continued long after the fix. In 2019, extensions with up to 4 million installs were caught leaking names and passwords to marketing intelligence firm Nacho Analytics, and by 2020 Google had removed 106 malicious extensions with 32 million downloads that harvested credentials, then moved against a cluster of 295 ad-injecting extensions reaching more than 80 million users.
First-order effects
- More than 9 million AVG customers had their browsing history potentially readable by third parties until Ormandy's disclosure forced a patch, making the antivirus vendor — not a shady developer — the source of the exposure.
Second-order effects
- Bundling browser extensions into consumer security products invites the same scrutiny as the threats those products claim to stop, pressuring vendors like AVG to justify forced installs to both users and Google's extension reviewers.
Third-order effects
- With researchers repeatedly surfacing mass-scale extension leaks — from AVG's 2015 flaw through the Nacho Analytics password leak and Google's removal of 106 credential-harvesting extensions — enforcement increasingly shifts to Google's store review process rather than vendor self-policing.
The trend: Browser extensions keep proving to be a systemic data-exposure surface, pushing Google toward acting as de facto gatekeeper of what software may ride inside Chrome.