---
title: Google Chrome Extensions are Being Sold to Malicious Adware Companies
description: Adware vendors are buying popular Chrome extensions in order to place malicious, ad-injected updates. An extension could change ownership without the user’s being informed that they have just been sold to a malicious malware company.
image: https://blog.miva.com/hubfs/chrome_extensions-1.jpeg
---

- [![Miva, Inc logo.](https://www.miva.com/images/logos/miva-type-white.svg)](https://www.miva.com)
- ![White X close button](https://www.miva.com/images/svg/icons/icon-x-white.svg)

- Why Choose Miva
  
    - Solutions
    - [Why Miva Simplify Complexity](https://www.miva.com/why-miva)
    - [Platform Overview A Complete Ecommerce Solution](https://www.miva.com/platform-overview)
    - [Miva Connect Real-time Native Connections](https://www.miva.com/miva-connect)
    - [Vexture AI-powered Product Discovery](https://www.miva.com/vexture)
    - [PageBuilder No-code Page Creation](https://www.miva.com/pagebuilder)
    - [MivaPay Flexible Native Payment Solution](https://www.miva.com/mivapay)
    - Business Type
    - [B2B Robust Business Tools Built-In](https://www.miva.com/b2b-ecommerce)
    - [B2C Designed for Agility](https://www.miva.com/b2c-ecommerce-platform)
    - [Hybrid B2B + B2C, All Managed Together](https://www.miva.com/b2b-dtc-ecommerce-platform)
- [Enterprise](https://www.miva.com/enterprise-ecommerce-platform)
- Resources
  
    - Community
    - [Customer Stories Case Studies and Featured Stores Built With Miva](https://www.miva.com/customer-stories)
    - [Technology Partners An Ecosystem Built for Flexibility](https://www.miva.com/partners)
    - [Agency Partners Helping You Build and Grow](https://www.miva.com/miva-agency-partners)
    - Resources
    - [Resource Center Browse Our Extensive Library](https://www.miva.com/ecommerce-strategy-resource-guides)
    - [Blog Explore Miva Insights on Ecommerce](https://blog.miva.com/)
    - [Documentation Answers for All Your Miva Questions](https://docs.miva.com/)
- [Get Pricing](https://www.miva.com/schedule-demo-admin)

[![Miva, Inc logo.](https://www.miva.com/images/logos/miva-type-white.svg)](https://www.miva.com)

- Why Choose Miva
  
    - Solutions
    - [Why Miva Simplify Complexity](https://www.miva.com/why-miva)
    - [Platform Overview A Complete Ecommerce Solution](https://www.miva.com/platform-overview)
    - [Miva Connect Real-time Native Connections](https://www.miva.com/miva-connect)
    - [Vexture AI-powered Product Discovery](https://www.miva.com/vexture)
    - [PageBuilder No-code Page Creation](https://www.miva.com/pagebuilder)
    - [MivaPay Flexible Native Payment Solution](https://www.miva.com/mivapay)
    - Business Type
    - [B2B Robust Business Tools Built-In](https://www.miva.com/b2b-ecommerce)
    - [B2C Designed for Agility](https://www.miva.com/b2c-ecommerce-platform)
    - [Hybrid B2B + B2C, All Managed Together](https://www.miva.com/b2b-dtc-ecommerce-platform)
  [![](https://www.miva.com/images/webp/apex-stat.webp)](https://www.miva.com/case-studies/apex-tools)
  
  Your Partner for Growth
  
  See how Apex Tool drove a 57% revenue lift with Miva's Vexture® solution.
- [Enterprise](https://www.miva.com/enterprise-ecommerce-platform)
- Resources
  
    - Community
    - [Customer Stories Case Studies and Featured Stores Built With Miva](https://www.miva.com/customer-stories)
    - [Technology Partners An Ecosystem Built for Flexibility](https://www.miva.com/partners)
    - [Agency Partners Helping You Build and Grow](https://www.miva.com/miva-agency-partners)
    - Resources
    - [Resource Center Browse Our Extensive Library](https://www.miva.com/ecommerce-strategy-resource-guides)
    - [Blog Explore Miva Insights on Ecommerce](https://blog.miva.com/)
    - [Documentation Answers for All Your Miva Questions](https://docs.miva.com/)

- [Get Pricing](https://www.miva.com/schedule-demo-admin)
- ![White, three-lined, menu icon.](https://www.miva.com/images/svg/icons/icon-menu.svg)

# Google Chrome Extensions are Being Sold to Malicious Adware Companies

By Miva | January 29, 2014

- [Ecommerce Selling](https://blog.miva.com/tag/ecommerce-selling)

![](https://blog.miva.com/hubfs/chrome_extensions-1.jpeg)

### Before You Read On...

See why top ecommerce brands use Miva’s no-code platform to run   
multiple stores, manage massive catalogs, and grow their revenue.

[Book a Demo of Miva](https://www.miva.com/schedule-demo-admin)

**Ron Amadeo from Ars Technica recently wrote [an article](https://arstechnica.com/security/2014/01/malware-vendors-buy-chrome-extensions-to-send-adware-filled-updates/) about adware vendors buying Chrome extensions in order to place malicious, ad-injected updates.**

Google Chrome has automatic updates in order to make sure that the users always running on the latest updates.  Obviously, Google Chrome is updated directly by Google.  However, this update process consequently includes Chrome’s extensions.  Chrome extensions are updated by the extension owners, and it is up to the user to determine if the extension owner is trustworthy or not.

**When users download an extension, they are giving the extension owner permission to push new code out to their browser at anytime.**

What has inevitably happened is that adware vendors are buying the extensions, and therefore the users, from extension authors.  These vendors are pushing adware out to every user of the extension, which can make for a dangerous browsing experience.

**One Google extension author gave [his personal account](https://www.labnol.org/internet/sold-chrome-extension/28377/) of this in his blog post entitled, “I Sold a Chrome Extension but it was a bad decision.”**

Amit Agarwal created a Feedly extension for Chrome in less than an hour and sold it unknowingly to an Adware vendor for a 4-figure offer.  The extension had 30,000+ users on Chrome at the time of sale.  The new owners pushed an update to the Chrome store, which injected adware and affiliate links into the users’ browsing experience.  While this extension has been removed due to the publicity that Agarwal’s remorseful confession made, this is a very common event in Chrome extensions.

**Injected ads [are allowed](https://developers.google.com/chrome/web-store/program_policies) in Chrome extensions, however Google’s policy states that it must be clearly disclosed to the user which app the ads are coming from.**  They are not allowed to interfere with native ads or website functionality.

Unfortunately, these malware-infested updates are sly and not easily diagnosed.  Even if the user figures out why their navigation is bogged-down, it is extremely difficult to remove the program.  Virus scanners are not able to detect the malicious JavaScript.  Even wiping out a computer and reinstalling the OS will not remove it because the extensions are synched to the user’s Google account.

**The biggest problem here is not the auto-updates themselves; it is an issue of a user’s trust.**  An extension could change ownership without the user ever being informed that their trust had just been sold to a malicious malware company.

The only thing users can do now to protect themselves is to stay informed of new updates or stop using extensions entirely.  Keeping informed of new updates will require yet another extension that will [notify](https://chrome.google.com/webstore/detail/extensions-update-notifie/nlldbplhbaopldicmcoogopmkonpebjm?hl=en) the user when other extensions get updated.

## Permission Warnings

![chrome_extensions_permissions](https://blog.miva.com/hs-fs/hubfs/chrome_extensions_permissions.png?width=288&name=chrome_extensions_permissions.png)

Chrome does require the user’s approval when extensions add [new permissions](https://developer.chrome.com/extensions/permission_warnings.html).  The permission that allows ad-injecting is called “Access your data on all web pages.”  While many legitimate extensions already use this permission, be aware that adware buyers could purchase an extension that already has this permission.

Google is not explicitly responsible for unwanted adware in the extensions, but they do plan on changing their [extension policy](https://blog.chromium.org/2013/12/keeping-chrome-extensions-simple.html) in June 2014.  This new policy will require extensions to serve only a single purpose that is narrow and easy-to-understand.  Each Chrome Extension will only be allowed a single visible UI “Surface” in Chrome.

*This blog post was based off of [this article](https://arstechnica.com/security/2014/01/malware-vendors-buy-chrome-extensions-to-send-adware-filled-updates/) on [ArsTechnica.com](https://arstechnica.com).*

[Back to top](https://blog.miva.com/google-chrome-extensions-are-being-sold-to-malicious-adware-companies#postAnchor)

### Want to read this blog offline?

No worries, download the PDF version now and enjoy your reading later...

Download PDF

![Image of Miva.](https://blog.miva.com/hubfs/Miva%2010/Miva%2010%20Email%20images/miva-logo-square.png) Miva

Miva offers a flexible and adaptable ecommerce platform that evolves with businesses and allows them to drive sales, maximize average order value, cut overhead costs, and increase revenue. Miva has been helping businesses realize their ecommerce potential for over 20 years and empowering retail, wholesale, and direct-to-consumer sellers across all industries to transform their business through ecommerce.

[Visit Website](https://www.miva.com/)

![White Miva, Inc logo.](https://www.miva.com/images/logos/miva-type-white.svg)

Powering the Next Era of Intelligent, Connected Commerce.

[Get Pricing](https://www.miva.com/schedule-demo-admin)

- [![White Facebook logo.](https://www.miva.com/images/svg/icons/icon-white-facebook.svg)](https://www.miva.com/social/facebook)
- [![White X logo.](https://www.miva.com/images/svg/icons/icon-white-x.svg)](https://www.miva.com/social/x)
- [![White LinkedIn logo.](https://www.miva.com/images/svg/icons/icon-white-linkedin.svg)](https://www.miva.com/social/linkedin)
- [![White Instagram logo.](https://www.miva.com/images/svg/icons/icon-white-instagram.svg)](https://www.miva.com/social/instagram)

![Badge displaying that Miva was named Best Ecommerce Platform in 2020 by Vendors In Partnership.](https://www.miva.com/images/badges/best-ecomm-platform-2020.webp)

- Solutions
- [Why Miva](https://www.miva.com/why-miva)
- [Platform Overview](https://www.miva.com/platform-overview)
- [Miva Connect](https://www.miva.com/miva-connect)
- [Vexture](https://www.miva.com/vexture)
- [PageBuilder](https://www.miva.com/pagebuilder)
- [MivaPay](https://www.miva.com/mivapay)
- [MultiStorefront](https://www.miva.com/miva-multistorefront)

- Business Type
- [B2B](https://www.miva.com/b2b-ecommerce)
- [B2C](https://www.miva.com/b2c-ecommerce-platform)
- [Hybrid](https://www.miva.com/b2b-dtc-ecommerce-platform)

- Community
- [Customer Stories](https://www.miva.com/customer-stories)
- [Technology Partners](https://www.miva.com/partners)
- [Agency Partners](https://www.miva.com/miva-agency-partners)
- [Forums](https://www.miva.com/forums/)

- Resources
- [Resource Center](https://www.miva.com/ecommerce-strategy-resource-guides)
- [Blog](https://blog.miva.com/)
- [Documentation](https://docs.miva.com/)
- [App Store](https://apps.miva.com/)
- [Miva Releases](https://www.miva.com/product-releases)

- Compare Miva
- [With Shopify](https://www.miva.com/miva-vs-shopify-plus)
- [With BigCommerce](https://www.miva.com/miva-vs-bigcommerce)
- [With Adobe Commerce (Magento)](https://www.miva.com/miva-vs-adobe-commerce-magento)
- [With Salesforce Commerce](https://www.miva.com/miva-vs-salesforce-commerce)

- Company
- [About](https://www.miva.com/company)
- [Leadership](https://www.miva.com/company/leadership)
- [Diversity & Inclusion](https://www.miva.com/company/diversity-inclusion)
- [Careers](https://www.miva.com/company/careers)
- [Press Center](https://www.miva.com/press/)

Copyright © 1997 – 2026 Miva®, Miva Merchant®, MivaPay®, Camp Miva®, Miva Connect®, Vexture®, Miva, Inc. All Rights Reserved. Terms & Policies

- [Privacy Policy](https://www.miva.com/privacy)
- [Cookie Policy](https://www.miva.com/cookie-policy)
- [Job Applicants Privacy](https://www.miva.com/miva-applicant-privacy-notice)
- [Intellectual Property](https://www.miva.com/intellectualproperty)
- [Terms of Service](https://www.miva.com/pdf/SaaS_TOS.pdf)
- [Non-Compliance Policy](https://www.miva.com/miva-software-updates)

```json
{
  "@context" : "https://schema.org",
  "@id" : "https://blog.miva.com/google-chrome-extensions-are-being-sold-to-malicious-adware-companies#webpage",
  "@type" : "WebPage",
  "description" : "Adware vendors are buying popular Chrome extensions in order to place malicious, ad-injected updates. An extension could change ownership without the user’s being informed that they have just been sold to a malicious malware company.",
  "inLanguage" : "en-US",
  "isPartOf" : {
    "@id" : "https://blog.miva.com/#website"
  },
  "name" : "Google Chrome Extensions are Being Sold to Malicious Adware Companies",
  "url" : "https://blog.miva.com/google-chrome-extensions-are-being-sold-to-malicious-adware-companies"
}
```

```json
{
  "@context" : "https://schema.org",
  "@type" : "BreadcrumbList",
  "itemListElement" : [ {
    "@type" : "ListItem",
    "item" : "https://www.miva.com/",
    "name" : "Home",
    "position" : 1
  }, {
    "@type" : "ListItem",
    "item" : "https://blog.miva.com/",
    "name" : "Blog",
    "position" : 2
  }, {
    "@type" : "ListItem",
    "item" : "https://blog.miva.com/google-chrome-extensions-are-being-sold-to-malicious-adware-companies",
    "name" : "Google Chrome Extensions are Being Sold to Malicious Adware Companies",
    "position" : 3
  } ]
}
```

```json
{
  "@context" : "https://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "Miva",
    "url" : "https://blog.miva.com/author/miva"
  },
  "dateModified" : "1629995543115",
  "datePublished" : "2014-01-29 00:00:00",
  "description" : "Adware vendors are buying popular Chrome extensions in order to place malicious, ad-injected updates. An extension could change ownership without the user’s being informed that they have just been sold to a malicious malware company.",
  "headline" : "Google Chrome Extensions are Being Sold to Malicious Adware Companies",
  "image" : {
    "@type" : "ImageObject",
    "height" : 630,
    "url" : "https://go.miva.com/hubfs/chrome_extensions-1.jpeg",
    "width" : 1200
  },
  "mainEntityOfPage" : {
    "@id" : "https://blog.miva.com/google-chrome-extensions-are-being-sold-to-malicious-adware-companies#webpage",
    "@type" : "WebPage"
  },
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "height" : 60,
      "url" : "https://www.miva.com/images/new-images/mivainc-logo.png",
      "width" : 300
    },
    "name" : "Miva",
    "url" : "https://www.miva.com/"
  },
  "url" : "https://blog.miva.com/google-chrome-extensions-are-being-sold-to-malicious-adware-companies"
}
```