Browser Extension Combines DNR + Broad Content-Script Perms for AI Hijack

Ibrahim Saud@tektrix

•updated Sep 17, 2026•1•0•2

Detects the installation or update of browser extensions that utilize 'declarativeNetRequest' or 'webRequest' APIs in conjunction with 'content_scripts' and either broad URL access ('all_urls') or access to sensitive web domains (e.g., Google Gemini, Microsoft Copilot, Perplexity, Claude). This combination is highly indicative of extensions designed for data interception, credential theft, or unauthorized web traffic manipulation.