AI Governance Institute logo
AI Governance Institute

Intelligence for Compliance and GRC Teams

← News
Research2026-08-11

Banned AI Chat-Scraping Extension Returns via Chrome's Own CDN

What happened

Netskope Threat Labs published research on August 11, 2026, documenting that a Chrome extension banned for stealing AI chats has returned to the Chrome Web Store after its initial removal in January 2026. The extension, now at version 1.7.3.0, carries code classified as Trojan.GenericFCA.Script.37952 that exploits browser update and uninstall events to generate affiliate commissions while maintaining access to user sessions. More critically, the extension retains the same functionality that earned its original ban: the ability to scrape conversations from AI assistants including ChatGPT and DeepSeek as users interact with them. Because the extension is distributed through Google's own CDN infrastructure, it bypasses many perimeter controls that rely on blocking unknown or untrusted domains. The incident is a direct continuation of an AI data exfiltration vector that enterprise security teams may have considered resolved after the January ban, and it demonstrates that platform-level removal is not a durable control against persistent threat actors who can simply resubmit.

Why it matters

  • ·AI conversation data flowing through browser extensions sits outside most enterprise DLP and CASB tooling, a gap documented earlier this year in CASB and DLP Cannot See Inside AI Prompts. This incident confirms that even after a malicious extension is removed from a platform store, the exfiltration risk resurfaces unless organizations maintain their own positive-allowlist controls over installed extensions.
  • ·The use of Google's CDN as the delivery channel directly undermines domain-blocklist approaches, meaning organizations that rely on network-layer filtering as their primary browser extension control now have a demonstrable gap in their third-party software intake process. Controls governing shadow AI and third-party widget inventory need to cover installed browser extensions that interact with sanctioned AI tools, not just standalone AI applications.
  • ·Enterprises in regulated industries where AI conversation content may contain personal data, privileged communications, or material non-public information face direct regulatory exposure if this extension reaches employee endpoints. Data exfiltration through a sanctioned distribution channel may constitute a notifiable breach under applicable data protection regimes, triggering incident disclosure obligations.

Governance controls affected

PRC-014Shadow AI and Third-Party Widget Inventory and ClassificationSEC-005Supply Chain Security for AI DependenciesDGC-002PII Handling in AI PipelinesIRC-001AI Incident Response PlaybookSEC-004Least-Privilege Access for AI Systems

What to do now

  • ☐Audit all browser extensions currently installed on enterprise endpoints that have permissions to read or modify content on AI assistant domains including chat.openai.com and chat.deepseek.com.
  • ☐Implement a positive allowlist for browser extensions on managed devices so that only explicitly approved extensions can run, rather than relying on Chrome Web Store removal actions as a control.
  • ☐Search endpoint management logs for installations of any extension previously flagged in January 2026 as scraping AI conversation data, including under new names or version numbers.
  • ☐Update your AI acceptable-use policy to explicitly require employees to report unsanctioned browser extensions that interact with AI tools, and communicate this requirement in the next training cycle.
  • ☐Assess whether any AI conversation content exfiltrated through this channel constitutes a reportable data incident under applicable data protection requirements, and initiate an incident classification review accordingly.

What to watch next

Compliance teams should monitor whether Google strengthens its Chrome Web Store review processes following this resubmission, since platform-level controls have now demonstrably failed twice on the same extension. The broader pattern of trojanized AI tooling reaching enterprise endpoints through trusted channels, including the earlier 1.7M trojanized AI skill installs incident, suggests that browser and marketplace supply chain security will face increasing regulatory scrutiny. Teams operating under the OWASP Top 10 for Large Language Model Applications framework should revisit their supply chain risk entries in light of this confirmed reinfection vector.

Stay ahead of stories like this

Get every Global AI governance development like this one, plus the rest of the week's developments. Every Thursday.

Powered by Buttondown.

Related Coverage

Enforcement2026-08-05

CISA Confirms Active Exploitation of Critical RCE Flaw in IBM Langflow

CISA has added CVE-2026-9198 to its Known Exploited Vulnerabilities catalog after confirming active exploitation of a critical remote code execution flaw in IBM-owned Langflow, a widely deployed low-code agentic AI workflow builder. The vulnerability allows unauthenticated attackers to execute arbitrary code and achieve full server takeover on default deployments. Enterprises running Langflow OSS versions 1.0.0 through 1.10.0 must upgrade to version 1.10.1 or later immediately.

Enforcement2026-08-10

181,874 Meetings Exposed After tl;dv Ignored Six-Month Disclosure

A security researcher found that tl;dv, an AI meeting recording platform used by more than two million people, left its entire Firestore meetings database readable by any authenticated user due to a missing tenant isolation control. The exposure covered 181,874 meeting records across 84,312 users, including government agencies in 23 countries, universities, and corporations. The vulnerability was disclosed in January 2026 but remained unpatched as of July 2026, despite the company's published claims of SOC2, GDPR, and EU AI Act compliance.

Research2026-08-06

11 Framework Flaws Put Every Agentic App Built on LangChain, AutoGen, and Google ADK at Risk

Check Point Research disclosed 11 vulnerabilities across five major AI agent frameworks, including LangChain, CrewAI, AutoGen, Microsoft Agent Framework, and Google ADK. The flaws include classic bug classes such as insecure deserialization and path traversal embedded in the infrastructure enterprises use to build agentic AI applications. A critical flaw in Microsoft Agent Framework enabled remote code execution triggered through prompt injection, while a Google ADK issue allowed unauthenticated code execution and credential theft on default cloud deployments.