Socket is bringing experimental protection to Firefox, scanning 97,000+ extensions in Mozilla's official directory for malware and risky updates.
- John Tuckner
Today, Socket is expanding its browser extension security coverage to Firefox, giving security teams visibility into the extensions used across their organizations and helping them identify malicious behavior, excessive permissions, data collection, suspicious infrastructure, and risky changes between versions.
Socket now proactively scans every Firefox extension listed in Mozilla's official addons.mozilla.org directory. At the time of publication, Mozilla's public API lists 97,100 Firefox-compatible extensions. We analyze those extensions and continue monitoring new releases so security teams can see when an extension's behavior changes.
Firefox Extensions Are an Enterprise Blind Spot
Firefox has built a loyal following among people who value privacy, customization, and an independent alternative to Chromium-based browsers. Extensions are central to that experience, giving users deep control over how the browser looks, behaves, and interacts with the web.
When Firefox 1.0 launched in November 2004, Mozilla highlighted more than 100 available extensions as a defining feature. The ecosystem later moved to the WebExtensions model with Firefox 57 in 2017, creating a more standardized framework shared with other browsers. Today, Mozilla says nearly half of Firefox users have installed at least one extension, with more than 10,000 developers contributing to the ecosystem.
That scale creates a significant security problem for enterprises. An extension can read and modify web pages, access browser tabs, interact with the clipboard, observe browsing activity, and communicate with external services. Security teams may be able to collect a list of extension IDs from managed browsers, but a name, publisher, install count, and permission list provide little visibility into what the code actually does, where it sends data, or whether its behavior changed in the latest version.
The hardest cases begin with something legitimate or harmless-looking. A productivity tool, theme, wallet, or utility can earn trust and remain installed for months. A later update can introduce credential theft, clipboard monitoring, traffic redirection, or data exfiltration under the same extension identity. If the update uses permissions the user already granted, the malicious behavior can arrive without a new permission prompt.
For release and beta versions of Firefox, extensions undergo automated validation and must be signed by Mozilla, though manual review may happen during submission or later. Updates from Mozilla’s official add-ons directory are delivered automatically, with a new prompt only when an update adds permissions. An extension can change behavior within existing permissions without another prompt, making ongoing analysis of each version essential.
A Trusted Extension Can Change Overnight
Socket's latest Firefox threat research shows how quickly that trust can be abused. We identified 77 linked Firefox extension identities active from at least March through August 2026. We confirmed 40 as malicious. Another 37 were deceptive sports-score shells connected through shared code, infrastructure, and version histories.
The malicious extensions delivered remotely controlled wallet-phishing pages, captured recovery phrases and private keys, exfiltrated wallet keyrings, or stole credentials and clipboard contents. One remote-loader cluster requested only storage
and tabs
, showing how an extension can present serious risk without an obviously alarming permission set.
Version history exposed the broader supply chain pattern. Nine confirmed malicious extension identities had previously shipped as sports-score shells before becoming wallet stealers. Others moved from utility names including Visited Link Marker and Flow Pomodoros to Rabby-style wallets carrying credential and clipboard-stealing code.
This is a common attack flow in the wider open source ecosystem. A harmless-looking utility can become wallet-stealing malware in its next automatic update. The user trusted one extension identity. The code behind that identity changed, and the browser's update mechanism delivered the new version. Install counts, reviews, familiar branding, and a clean initial release offer little protection once an extension is repurposed.
Proactive Analysis Across Firefox Add-ons
Socket brings the same proactive supply chain analysis used across open source package ecosystems to Firefox extensions:
- Visibility: See extension metadata, requested permissions, active sites, and the files and behaviors behind each alert.
- Threat detection: Identify malware, credential and clipboard theft, data exfiltration, remote code and content loading, suspicious network endpoints, obfuscation, impersonation, and other risky behavior across extensions in Mozilla's official directory.
- Update monitoring: Compare releases under the same extension identity and surface meaningful changes in permissions, code, network activity, and behavior.
- Ecosystem context: Connect individual findings to related extensions, reused code, shared infrastructure, publisher patterns, and coordinated campaigns.
Permission review remains useful, but permissions alone do not explain intent. The recent Firefox campaign included extensions with broad access as well as remote loaders that needed only limited permissions. Socket analyzes the code, metadata, infrastructure, and version history together so teams can investigate the behavior behind the manifest.
This gives enterprise security teams a practical way to answer basic questions that have remained difficult at scale: Which Firefox extensions are present in the organization? What can they access? What do they do with that access? Which ones have changed since approval? Which updates introduce new risk?
Available in Experimental for Enterprise Customers
Firefox extension protection is now available in Experimental to Socket enterprise customers. This release expands the browser extension coverage we introduced with Chrome and gives organizations a consistent way to evaluate extension risk across both ecosystems.
Enterprise customers can contact their Socket account team to enable the experimental Firefox coverage. Organizations interested in evaluating Socket for browser extension security can contact us to get started.