Two popular Google Chrome extensions have been reported as malicious following ownership transfers, exposing users to serious security threats, including code injection and data theft. The extensions in question, QuickLens and ShotBird, were initially developed by Akshay Anu Online and had earned thousands of users for their advertised functionality. QuickLens, which allowed users to search screens using Google Lens, had over 7,000 active users, while ShotBird, a tool for scrolling screenshots and editing tweet images, had approximately 800 users.
The malicious activity reportedly emerged after the extensions changed hands. QuickLens was sold on ExtensionHub in October 2025, merely two days after its initial publication, and by February 2026, its ownership was listed under “support@doodlebuggle.top.” Similarly, ShotBird was transferred to a new developer, “loraprice198865@gmail.com,” last month. Both changes raised concerns among cybersecurity researchers, highlighting how ownership transfers of legitimate extensions can be exploited to introduce harmful code.
Security research by MonxResearch-Sec revealed that the transferred extensions could be used to inject arbitrary scripts into users’ browsers and potentially harvest sensitive information such as passwords, browsing history, and other personal data. QuickLens has already been removed from the Chrome Web Store due to these threats, but ShotBird remains accessible to users, posing an ongoing risk.
The initial developer, Akshay Anu, had promoted ShotBird as a professional-grade tool for creating studio-like visuals with local processing. QuickLens, similarly, was marketed for enhancing Google Lens searches directly in the browser. Both extensions even received recognition, with ShotBird being flagged as “Featured” in January 2025. However, once ownership changed, the extensions’ security posture significantly deteriorated, illustrating a growing risk in the Chrome Web Store ecosystem where attackers can take control of legitimate software to exploit users.
Cybersecurity experts stress that users should remain vigilant when installing or updating browser extensions. It is crucial to verify developers, monitor user reviews, and limit permissions to only what is strictly necessary. Organizations and individuals using Chrome extensions should also consider adopting enterprise policies to restrict unauthorized extensions and conduct regular audits of installed add-ons.
This incident is a warning for the broader tech ecosystem, emphasizing the vulnerability of widely used digital tools when ownership changes are not properly monitored. Browser extensions, due to their integration with user data and browsing activity, are a high-value target for attackers, making proactive security practices essential. Users should also enable multi-factor authentication for accounts linked to Chrome and regularly update browser software to mitigate potential exploits.
With cybercriminals increasingly targeting popular extensions, these incidents underscore the importance of robust security oversight, both by developers and platform providers like Google. Ensuring the integrity of extensions and safeguarding users’ data is critical to maintaining trust in widely used web tools.
