Flawed Chrome extension forcibly installed by AVG antivirus software could have exposed browsing history and other personal data of 9M+ users, has been patched
Sean Gallagher / Ars Technica :
Context & Ripple Effects
AVG, a company whose product is supposed to reduce users' exposure, turned out to be the exposure: it force-installed a flawed Chrome extension on more than 9 million people, a flaw surfaced by Google Project Zero researcher Tavis Ormandy and since patched. The episode lands on top of an earlier self-inflicted wound — the same forced-install extension story broke the day before this analysis — and follows a familiar AVG pattern of update missteps dating back to a mandatory 2011 update that broke 64-bit Windows 7 machines outright.
What makes it more than one vendor's bug is where it sits in the extension ecosystem's record: two years earlier, extensions with up to 4M installs were leaking names and passwords to marketing-intelligence firm Nacho Analytics (the Nacho Analytics leak), and by mid-2020 Google was pulling batches of malicious extensions en masse — 106 extensions with 32M downloads harvesting browsing history and credentials, then a cluster of 295 ad-injecting extensions reaching more than 80M users. AVG's flaw shows the problem isn't confined to shadowy publishers; trusted security brands ship it too.
First-order effects
- More than 9 million AVG users had browsing history and personal data potentially exposed through an extension they never chose to install; the patch closes the hole but doesn't recall whatever was already visible.
- AVG takes a direct credibility hit: a security vendor's own forced software became the vulnerability, discovered not by AVG but by Google Project Zero.
Second-order effects
- Trust in bundled 'security extras' erodes for the whole antivirus category — every vendor shipping browser add-ons now has to justify them, since AVG demonstrated that forced installation converts a convenience feature into a liability at scale.
- Browser-platform owners like Google face mounting pressure to gatekeep extensions harder, a pressure the corpus shows materializing as mass removals of hundreds of millions of installs' worth of malicious code.
Third-order effects
- If the pattern holds — vendor-shipped flaws, data-broker leaks, and ad injection recurring across years — browser extensions harden from an open ecosystem into a tightly reviewed, permission-gated layer, with distribution power concentrating in the browser vendors who control the review process.
- Security software itself becomes part of the attack surface it sells against, pushing the industry toward treating bundled components with the same scrutiny it applies to external threats.
The trend: Browser extensions keep proving to be one of the web's most persistent personal-data leak channels, and each incident — including ones from trusted security vendors — pushes control further toward the browser platforms themselves.