Google Moves to Protect Chrome Users From Cryptojacking and Hacks

Google is bringing in stricter rules for Chrome extension developers, a move should reduce the risk of crypto hacks and mining malware.

Announced Monday, the web and technology giant is planning a series of changes to the way Chrome handles extensions that request extensive permissions, and is also tightening the rules for developers distributing extensions via the Chrome Web Store.

"It's crucial that users be able to trust the extensions they install are safe, privacy-preserving, and performant. Users should always have full transparency about the scope of their extensions' capabilities and data access."

From Chrome 70, users will have the ability to restrict an extension's access to a custom list of sites, or to set extensions to require permission each time they need to gain access to a page, the company explains.

The firm explains the move, saying "While host permissions have enabled thousands of powerful and creative extension use cases, they have also led to a broad range of misuse - both malicious and unintentional ... Our aim is to improve user transparency and control over when extensions are able to access site data."

Google also said that, from Monday, Chrome Web Store will no longer allow extensions with hidden, or obfuscated, code.

According to the post, more than 70 percent of "Malicious and policy violating extensions" that Google blocks from the Web Store contain obfuscated code.

Further, as obfuscation is "Mainly used to conceal code functionality," it greatly adds to the complexity of the Google's extension review process.

In the past, Chrome extensions have been used by cyber-criminals to provide access to victims machines.

People who used the official installer over the next few hours had their accounts compromised, according to ZDNet - including users of the MyEtherWallet and MyMonero crypto wallets, and decentralized exchange IDEX. Google has also been forced to crack down on extensions that used downloaders' devices to mine cryptocurrencies without their knowledge.