Chromium Blog
News and developments from the open source browser project
Protecting users from extension cryptojacking
Monday, April 2, 2018
As the extensions ecosystem continues to evolve, we remain focused on empowering developers to build innovative experiences while keeping our users as safe as possible. Over the past few months, there has been a rise in malicious extensions that appear to provide useful functionality on the surface, while embedding hidden cryptocurrency mining scripts that run in the background without the user’s consent. These mining scripts often consume significant CPU resources, and can severely impact system performance and power consumption.
The chart above shows a recent example of CPU overutilization from hidden coin mining in an extension.
Until now, Chrome Web Store policy has permitted cryptocurrency mining in extensions as long as it is the extension’s
single purpose
, and the user is
adequately informed
about the mining behavior. Unfortunately, approximately 90% of all extensions with mining scripts that developers have attempted to upload to Chrome Web Store have failed to comply with these policies, and have been either rejected or removed from the store.
Starting today, Chrome Web Store will no longer accept extensions that mine cryptocurrency. Existing extensions that mine cryptocurrency will be delisted from the Chrome Web Store in late June. Extensions with blockchain-related purposes other than mining will continue to be permitted in the Web Store.
The extensions platform provides powerful capabilities that have enabled our developer community to build a vibrant catalog of extensions that help users get the most out of Chrome. Unfortunately, these same capabilities have attracted malicious software developers who attempt to abuse the platform at the expense of users. This policy is another step forward in ensuring that Chrome users can enjoy the benefits of extensions without exposing themselves to hidden risks.
Posted by James Wagner, Extensions Platform Product Manager
Labels
$200K
1
10th birthday
4
abusive ads
1
accessibility
1
benchmarks
1
beta
12
billing
1
birthday
4
blink
1
browser
2
browser interoperability
1
capabilities
3
capable web
1
cds18
2
cds2018
1
chrome
9
chrome apps
3
chrome dev summit 2018
1
Chrome Frame
1
chrome web store
27
chromedevtools
1
chromeframe
3
chromeos
3
chromium
3
cloud print
1
dart
8
dashboard
1
day 2
1
design
1
devtools
12
extensions
24
features
1
feedback
2
field data
1
frameworks
1
fund
1
funding
1
gdd
1
googlechrome
12
harmful ads
1
html5
11
incognito
1
javascript
3
lab data
1
lighthouse
1
linux
2
mac
1
mobile
2
na
1
native client
8
New Features
5
octane
1
open web
3
pagespeedinsights
1
performance
2
performance tools
1
portals
1
protection
1
releases
3
rlz
1
security
30
spdy
2
speed
1
ssl
2
subscription pages
1
tools
1
v8
6
web intents
1
web packaging
1
web.dev
1
webapi
1
webaudio
3
webgl
7
webkit
5
webmaster
1
webp
5
webrtc
4
websockets
5
webtiming
1
writable-files
1
Archive
2018
Nov
Oct
Sep
Aug
Jul
Jun
May
Apr
Mar
Feb
Jan
2017
Dec
Nov
Oct
Sep
Aug
Jul
Jun
May
Apr
Mar
Feb
Jan
2016
Dec
Nov
Oct
Sep
Aug
Jun
May
Apr
Mar
Feb
Jan
2015
Dec
Nov
Oct
Sep
Aug
Jul
Jun
May
Apr
Mar
Feb
Jan
2014
Dec
Nov
Oct
Sep
Aug
Jul
Jun
May
Apr
Mar
Feb
Jan
2013
Dec
Nov
Oct
Sep
Aug
Jul
Jun
May
Apr
Mar
Feb
Jan
2012
Dec
Nov
Oct
Sep
Aug
Jul
Jun
May
Apr
Mar
Feb
Jan
2011
Dec
Nov
Oct
Sep
Aug
Jul
Jun
May
Apr
Mar
Feb
Jan
2010
Dec
Nov
Oct
Sep
Aug
Jul
Jun
May
Apr
Mar
Feb
Jan
2009
Dec
Nov
Sep
Aug
Jul
Jun
May
Apr
Mar
Feb
Jan
2008
Dec
Nov
Oct
Sep
Feed
Google
on
Follow @ChromiumDev
Give us feedback in our
Product Forums
.
