The news is out that the latest update out from Adobe for its Acrobat Reader for Windows does something that I find distasteful. It silently installs an extension into your Google Chrome browser. After you update Acrobat Reader, the next time you open Chrome it will note the new extension and ask if you want to enable it or remove it.
The problem is this:
The installation process is covert, but the next time users open their Chrome browser, they’ll be notified by Chrome’s security systems that a new extension has been added.
The extensions name is Adobe Acrobat and is the same extension available through the Chrome Web Store.
Let me focus on three things. First is the fact that the “installation process is covert” meaning that you are not told that this is going to happen when you update Adobe Acrobat Reader. Which in turn would give you the choice as to if you want it installed or not. But I bet that lots of users are going to say yes when the prompt to enable it pops up in Chrome and I bet that is what Adobe is counting on. The second thing that I want to focus on is the fact that the extension in question is available on the Chrome Web Store. That means that if you really wanted this, you had an avenue to get it. So one has to wonder why Adobe is now forcing it upon users? Finally, Chrome offers pretty good native PDF support. So why even bother having more software installed?
Now the cyinic in me sees this as the real reason behind this:
The Adobe Acrobat extension also comes with anonymous usage data collection turned on by default, which might scare some users.
According to Adobe, extension users “share information with Adobe about how [they] use the application.”
“The information is anonymous and will help us improve product quality and features,” Adobe also says.
Digging deeper into this data collection mechanism, we see that Adobe collects the following user information:
- Browser type and version
- Adobe product information such as version
- Adobe feature usage such as menu options or buttons selected
“Since no personally identifiable information is collected, the anonymous data will not be meaningful to anyone outside of Adobe,” the company says.
I’m sorry, but force feeding me a browser extension that phones home doesn’t exactly give me the warm fuzzies.
Now there’s one thing that popped to mind as I was typing this.Chrome has come bundled with Adobe products such as Flash. If you want to see this in action, install or update Flash. You’ll see that installing Google Chrome is an option (that to be frank I remove 100% of the time). Is there a connection?
That’s a question that I would love to have an answer to.
UPDATE: Clearly this story got Adobe’s attention. 24 Minutes after posting this, I got this Tweet:
Fake AI Chrome extensions with 300K users steal credentials, emails
Posted in Commentary with tags Chrome, Hacked on February 13, 2026 by itnerdThere’s news that’s out which details a set of 30 malicious Chrome extensions installed by more than 300,000 users are masquerading as AI assistants to steal credentials, email content, and browsing information.
Borja Rodriguez, Manager of Threat Intelligence Operations at Outpost24, has provided the following commentary:
“We have repeatedly seen malicious browser extensions bypass review processes and reach significant user adoption before removal. In this case, some extensions accumulated tens of thousands of installs, and others remain available even after public disclosure. That raises legitimate questions about the effectiveness, speed, and consistency of Google’s vetting and monitoring mechanisms for Chrome Web Store submissions.
Over the past few years, Google has demonstrated that it can strictly enforce policy decisions when they align with its strategic priorities, including restrictions that affected ad and tracker blocking extensions. That level of enforcement shows the company has both the technical capability and operational control to act decisively when it chooses to.
However, malicious extensions continue to surface and operate at scale. This suggests that either the automated review systems are insufficient to detect certain abuse patterns, or post publication monitoring and rapid takedown processes are not robust enough to limit exposure. Given the scale of Chrome’s user base, even a short window of exposure can translate into hundreds of thousands of victims.
The broader concern is trust. Users reasonably assume that extensions listed in an official store have undergone meaningful security scrutiny. When campaigns like this repeatedly succeed, that trust erodes. Stronger proactive detection, improved behavioral analysis of extensions after publication, and faster response cycles are essential to reduce systemic risk.”
This once again highlights the fact that just because something exists, doesn’t mean that you should install it. Especially in the age of AI where your attempt to use what I call “the new hotness” may get you pwned.
Leave a comment »