A browser extension that monitors installed extensions for ownership transfers, permission scope changes, and suspicious outbound data requests in real time

Chrome extensions are a weaponized attack surface with no end-user runtime defense. Three documented incidents expose the gap: Honey hijacked affiliate cookies for millions of users (MegaLag expose: 9.4M YouTube views, 4M Chrome users lost); Urban VPN and 7 related extensions silently intercepted 8M users ChatGPT, Claude, and Gemini conversations and sold them to a data broker via a silent update; QuickLens and ShotBird were purchased by threat actors in Feb 2026 and turned malicious within weeks, stripping CSP headers and injecting remote JS on every page load. The Chrome Web Store review system does not alert existing users when an extension changes ownership or gains new permissions post-install. No consumer-facing tool watches for these events at runtime. This extension sits inside Chrome, monitors every other installed extension for developer/publisher changes, permission manifest diffs, and anomalous outbound network requests (especially to AI conversation endpoints), and surfaces alerts before damage is done.