Chromium-based Browser Extension Sideloading via Developer Mode

Lacey Cochrane@NullVectorX

•updated Aug 4, 2026•2•0•5

Detects the execution of Chromium-based browsers (Chrome, Edge, Brave, Chromium) using command-line arguments '--load-extension' or '--disable-extensions-except'. These flags are typically used for development purposes but are abused by attackers to sideload malicious, unpacked extensions, bypassing the browser's extension store review process and enabling techniques such as credential theft or C2 persistence.