Rapid redirect to Google account page following silent mod install

Ethan Andrews@eandrews

•updated Jul 6, 2026•2•0•3

Detects browser navigation to sensitive Google account pages (e.g., myaccount.google.com/contactemail) occurring within 10 seconds of a browser extension installation. This pattern is consistent with automated redirects used to trigger Cross-Site Scripting (XS-Leak) vulnerabilities, potentially allowing attackers to exfiltrate sensitive user data or information via malicious extensions before the user can intervene.