Originally published on ExtensionBooster .

If your Chrome extension is compromised, a malicious update can reach your users within hours, because Chrome checks installed extensions for updates "every few hours." In December 2024, one phishing campaign got into at least 35 extensions with more than 2.6 million users. Here is a response plan in three phases (first hour, first day, first month) that you can copy into your repo before you ever need it.

How attackers actually get in

Two-step verification is not enough on its own. These are the three routes that keep coming up:

Route What happens What to lock down

Malicious OAuth app A fake "Chrome Web Store Developer Support" email leads to a consent screen. You grant an attacker's app publishing access, and 2FA never triggers. This is how Cyberhaven was hit in December 2024. Third-party app connections on your Google account

Leaked CI credentials The Chrome Web Store API client secret and refresh token in CI can publish just as well as you can.…