MALICIOUS CHROME EXTENSIONS CAN SPOOF PASSWORD MANAGERS IN NEW ATTACK

Summary from the TLDR InfoSec newsletter

Researchers at SquareX Labs developed a new “polymorphic” attack allowing malicious Chrome extensions to steal sensitive data. Once a user is tricked into installing the extension, it scans for password managers, impersonates them, and prompts users to reauthenticate, sending the information to attackers. SquareX Labs has urged Google to restrict extensions' ability to alter their appearance or behavior, but no mitigations currently exist for this attack.