Unit 42 Threat Bulletin - April 2026

The browser is no longer just a user interface. It’s an identity-bearing execution layer where unvetted code can access business data by design. Browser extensions are widely used across enterprises, but they operate with privileges traditional malware typically can’t reach without deeper access. They can quietly exfiltrate identity and content.

Unit 42 research shows these extensions are increasingly being generated using AI and operate across Chromium-based browsers, which represent roughly 95% of enterprise usage.

Shresta Bellary Seetharam: Most enterprise work, including payroll, cloud access and collaboration, now happens in the browser. Extensions help users move faster, so they install them freely. But they run in a privileged layer with access to content, credentials and identity in ways traditional software does not have. Hundreds of GenAI-focused extensions are already in use across enterprise environments. The exposure is there. Most organizations just have not mapped it.

Nabeel Mohamed: The moment it’s installed, an extension can inherit the user’s identity, including access to authenticated sessions in the browser. A summarization tool, for example, can appear to perform exactly as advertised while exfiltrating everything it reads to an attacker-controlled endpoint. These extensions often request access to all URLs visited, not just selected pages, and emit signals benign enough to bypass endpoint controls and firewalls. Users have no mechanism to identify whether an extension is using permissions it shouldn’t, or whether it has undocumented backdoor functionality.

NM: AI has driven the cost of generating new variants close to zero. Attackers can create many different-looking extensions that all perform the same malicious function, which breaks traditional blocklist approaches.

They also build in anti-detection. Extensions can recognize when they are running in a sandbox and stay dormant, only activating in real user environments. And because extensions update automatically, they can shift from benign to malicious over time without users noticing.

We’ve also seen legitimate extensions with large user bases get hijacked, with malicious code introduced in later updates.

SBS: Three priorities. First, treat extensions like any other third-party software. Default to deny, and only allow them after they’ve been vetted through an automated process. Manual review does not scale.

Second, don’t rely on a simple allow or block model. The same tool may be acceptable on public websites but not on internal systems like payroll or collaboration platforms. Controls need to reflect that.

Third, monitor continuously. With AI accelerating how quickly these extensions can be deployed and changed, the gap between install and compromise is no longer measured in days. It can happen almost immediately.

Beliz Kaleli: We’ve always treated user input as untrusted, but assumed web pages, documents, and database content were safe, passive data.

That breaks with AI agents. Anything they read can act as an instruction. The attack surface is no longer just user input. It’s everything the agent processes. You can’t validate only what users send. You have to treat all accessible data as potentially untrusted.

BK: Traditional breaches focus on stealing data. Indirect prompt injection changes behavior. It can cause an AI agent to take real actions and manipulate the AI agent’s decision-making.

If the agent has access to payments, databases, or APIs, a single malicious instruction can trigger actions across systems. And because those actions use the AI’s legitimate permissions, they often look normal and slip past existing controls.

The question shifts from “what data could be stolen?” to “what could be done using our system’s access?”

BK: The trust tax is what you pay to make AI safe. Adding human checks reduces the efficiency that made AI attractive in the first place.

In practice, it means slower rollouts, less autonomy, and more oversight. Lower-risk tasks can still be automated. But for high-stakes use cases, you need human checkpoints, which limits full autonomy.

That trade-off is real, and organizations need to be clear about it before they deploy.

BK: Start with least privilege. Agents should only have access to what they actually need. For high-impact actions, require an extra layer of approval.

You also need to validate what the agent produces before it executes. Look for outputs that fall outside expected patterns. And design the system so agents don’t directly interact with critical systems without controls in place. Logging matters too. You need to be able to trace what the agent saw and why it acted.

On the vendor side, focus on three things. How does the model handle instructions embedded in external data? What visibility do you have into its decision-making? And can you detect when behavior starts to drift?