Many Google Chrome and Microsoft Edge browser add-ons, including several prominent products, were found to be spying on users and communicating with a third-party server, in what appears to be a supply-chain attack with millions of victims.

The Geco extension has more than 800 reviews on the Chrome Web Store, 4.2 stars (out of 5), and "featured" placement. Microsoft's Edge Add-ons shows similarly glowing write-ups from its 1,000-plus users, and it looks like a perfectly safe extension.

According to researchers at Koi Security, the malicious extensions were part of a coordinated operation involving at least 18 known add-ons listed on the Chrome and

Researchers from Koi Security have detected 18 malicious Chrome and Edge extensions masquerading as benign productivity and entertainment tools

This latest incident marks the fourth actively exploited zero-day vulnerability fixed in Chrome this year. It follows three other security flaws: CVE-2025-2783 disclosed in March, CVE-2025-4664 patched in May, and CVE-2025-5419 addressed in June. Each of these vulnerabilities were considered critical and patched through emergency updates.

Users can use a shortcut parameter to limit the amount of cache Google Chrome uses. Unfortunately, there is no option within the program itself.