Back Cybersecuritynews

Pixel Perfect Extension Abuse Enables Covert Script Injection and Security Header Removal

Cybersecuritynews •Tushar Subhra Dutta • March 2, 2026

A browser extension that once earned a Featured badge from Google quietly turned into a remote code execution tool after its ownership changed hands, exposing thousands of users to covert script injection and full browser security header stripping. The campaign, centered on a legitimate-looking Google Lens wrapper called QuickLens, highlights how even a well-reviewed, functional […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

QuickLens Chrome Extension Compromised to Steal Crypto Credentials The QuickLens Chrome extension, which allowed users to perform Google Lens searches, was compromised on February 17, 2026, with the release of version 5.8 that introduced malware capable of stealing cryptocurrency credentials. Approximately 7,000 users were affected before the extension was removed from the Chrome Web Store. Researchers identified that the malicious update enabled remote code execution, posing significant risks to users' crypto assets. 8 sources 29

Extracted Entities

Pixel Perfect Extension Abuse Enables Covert Script Injection and Security Header Removal

The full story

Extracted Entities

Attack Types (1)

MITRE ATT&CK (1)

Tools (1)