Chrome, Firefox browser extensions leaked millions of users' data

Agencies
July 20, 2019

Popular browser extensions like ad blockers have been caught harvesting personal data of millions of consumers who use Chrome and Firefox -- not only their browsing histories but also exposing tax returns, medical records, credit card information and other sensitive data in the public domain.

According to an independent cyber security researcher Sam Jadali, the data has been leaked to a fee-based company called Nacho Analytics that gives unlimited access to any websites analytics data.

The data could be purchased for as little as $10 to $50, said Jadali whose report was first described in Ars Technica late on Friday.

"This non-stop flow of sensitive data over the past seven months has resulted in the publication of links to home and business surveillance videos hosted on Nest and other security services.

"Tax returns, billing invoices, business documents, and presentation slides posted to, or hosted on, Microsoft OneDrive, Intuit.com, and other online services" have been exposed, said the report.

The exposed data via eight browser extensions also include vehicle identification, numbers of recently bought automobiles, along with the names and addresses of the buyers.

Patient details, travel itineraries, Facebook Messenger attachments and Facebook photos, even private, are now available in the public domain.

Browser extensions - also known as plug-ins or add-ons - are apps that consumers can install to run alongside their browser for additional functionality.

The affected extensions were apps used by millions of people, including HoverZoom, SpeakIt!, and FairShare Unlock.

"The extensions have been remotely removed or disabled in consumers' browsers and are no longer available for download," said both Google and Firefox.

People who didn't download the extensions may also be affected.

"Nobody is immune to this. Even if you don't have any harmful extensions, the other people you interact with may have an extension on their computers that could be leaking the data you share with them," Jadali was quoted as saying.

Nacho Analytics, for example, promises to let people "see anyone's analytics account" and to provide "real-time web analytics for any website".

The company charges $49 per month, per domain, to monitor any of the top 5,000 most widely-trafficked websites.

The security expert has suggested users to delete all browser extensions they have installed in the past.

Comments

Add new comment

  • Coastaldigest.com reserves the right to delete or block any comments.
  • Coastaldigset.com is not responsible for its readers’ comments.
  • Comments that are abusive, incendiary or irrelevant are strictly prohibited.
  • Please use a genuine email ID and provide your name to avoid reject.
News Network
December 4,2025

Mangaluru: Chaos erupted at Mangaluru International Airport (MIA) after IndiGo flight 6E 5150, bound for Mumbai, was repeatedly delayed and ultimately cancelled, leaving around 100 passengers stranded overnight. The incident highlights the ongoing country-wide operational disruptions affecting the airline, largely due to the implementation of new Flight Duty Time Limitations (FDTL) norms for crew.

The flight was initially scheduled for 9:25 PM on Tuesday but was first postponed to 11:40 PM, then midnight, before being cancelled around 3:00 AM. Passengers expressed frustration over last-minute communication and the lack of clarity, with elderly and ailing travellers particularly affected. “Though the airline arranged food, there was no proper communication, leaving us confused,” said one family member.

An IndiGo executive at MIA cited the FDTL rules, designed to prevent pilot fatigue by limiting crew working hours, as the cause of the cancellation. While alternative arrangements, including hotel stays, were offered, about 100 passengers chose to remain at the airport, creating tension. A replacement flight was arranged but also faced delays due to the same constraints, finally departing for Mumbai around 1:45 PM on Wednesday. Passengers either flew, requested refunds, or postponed their travel.

The Mangaluru delay is part of a broader crisis for IndiGo. The airline has been forced to make “calibrated schedule adjustments”—a euphemism for widespread cancellations and delays—after stricter FDTL norms came into effect on November 1.

While an IndiGo spokesperson acknowledged unavoidable flight disruptions due to technology issues, operational requirements, and the updated crew rostering rules, the DGCA has intervened, summoning senior airline officials to explain the chaos and outline corrective measures.

The ripple effect has been felt across the country, with major hubs like Bengaluru and Mumbai reporting numerous cancellations. The Mangaluru incident underscores the systemic operational strain currently confronting India’s largest carrier, leaving passengers nationwide grappling with uncertainty and delays.

Comments

Add new comment

  • Coastaldigest.com reserves the right to delete or block any comments.
  • Coastaldigset.com is not responsible for its readers’ comments.
  • Comments that are abusive, incendiary or irrelevant are strictly prohibited.
  • Please use a genuine email ID and provide your name to avoid reject.
News Network
November 21,2025

malpe.jpg

Udupi: The Malpe Police have arrested two men from Uttar Pradesh for allegedly sharing classified information related to Indian Navy vessels with individuals in Pakistan, posing a serious threat to national security.

According to a complaint filed by the CEO of Udupi Cochin Shipyard, Malpe—an institution under the Union Ministry of Ports, Shipping and Waterways—the prime accused, Rohit (29), was working as an insulator through subcontractor M/S Shushma Marine Pvt Ltd. He had earlier served at Cochin Shipyard Limited in Kochi, Kerala, where naval ships are under construction.

Udupi SP Hariram Shankar said the accused had unlawfully shared, via WhatsApp, confidential identification numbers of Navy-related ships and other classified details while working in Kerala, allegedly for illegal gains.

After joining the Malpe shipyard unit, Rohit reportedly continued collecting sensitive information through a friend in Kochi and circulated it to unauthorised individuals, violating national security protocols and potentially endangering India’s sovereignty, unity, and integrity.

Based on the complaint, Malpe Police registered a case under Section 152 of the Bharatiya Nyaya Sanhita (BNS) and Sections 3 and 5 of the Official Secrets Act, 1923.

A police team led by Karkala Subdivision Assistant Superintendent of Police Harsha Priyamvada—along with PSI Anil Kumar D, ASI Harish, and PC Ravi Jadhav—conducted the investigation and arrested the two accused, identified as Rohit (29) and Santri (37), both residents of Sultanpur district, Uttar Pradesh.

The duo was produced before the court, which remanded them in judicial custody till December 3. Further investigation is in progress.

Comments

Add new comment

  • Coastaldigest.com reserves the right to delete or block any comments.
  • Coastaldigset.com is not responsible for its readers’ comments.
  • Comments that are abusive, incendiary or irrelevant are strictly prohibited.
  • Please use a genuine email ID and provide your name to avoid reject.
News Network
December 2,2025

DKSsiddu.jpg

Bengaluru: 'Nati koli saaru' (country chicken curry) considered one of Chief Minister Siddaramaiah’s favourites along with steaming hot idlis was on the breakfast menu at Deputy CM D K Shivakumar’s residence on Tuesday, according to official sources.

The spread also included 'nati koli' fry, vada and pongal, among other items, they said.

In an apparent show of unity, Siddaramaiah visited Shivakumar’s residence for breakfast, just days after the two leaders shared a meal amid a simmering power tussle in the state Congress.

Siddaramaiah drove to the Deputy CM’s residence in Sadashivanagar, where he was received by Shivakumar and his brother D K Suresh, who is a former Congress MP.

Suresh and Kunigal MLA H D Ranganath, a relative of Shivakumar, joined them for breakfast, which featured a mix of vegetarian and non-vegetarian dishes.

Speaking to reporters later, Siddaramaiah said Shivakumar had invited him during his visit to the CM’s residence for breakfast on Saturday.

Asked about the difference between the two meals, the chief minister said, "At his (Shivakumar’s) house it was non-veg, while at my house it was veg. He is a vegetarian, I am a non-vegetarian. I had not prepared non-veg. I told DK to get chicken from the village as you won’t get the original in Bengaluru."

Shivakumar said he had initially invited Siddaramaiah to his residence, but the CM had suggested visiting his place first and reciprocating later. "It was a vegetarian breakfast at the CM’s house on Saturday," he noted.

"Today, I invited him (the CM) to my house. He enjoyed the breakfast, which had his Mysuru taste," Shivakumar added. At this point, Siddaramaiah remarked that Shivakumar’s wife is also from Mysuru.

Saturday’s breakfast at Siddaramaiah’s official residence, held as part of efforts by the Congress high command to ease tensions in the leadership dispute between the two, reportedly included idlis and sambar, according to official sources.

Comments

Add new comment

  • Coastaldigest.com reserves the right to delete or block any comments.
  • Coastaldigset.com is not responsible for its readers’ comments.
  • Comments that are abusive, incendiary or irrelevant are strictly prohibited.
  • Please use a genuine email ID and provide your name to avoid reject.