While browsing, you might encounter a warning that takes over your screen, claiming your browser requires a “Critical Update” to continue. This resembles Chrome, and the urgency of the message can prompt a quick click on the Update button, which is exactly what makes this fake Chrome update scam so deceptive.
Recently, reports have connected aggressive fake browser update alerts to a Chrome extension named Enable Right Click & Copy – Smart Unlock + OCR. Initially, this extension was designed to help users regain the ability to right-click and copy on websites that block such actions. However, security analysts at Socket discovered that the extension had been acquired by a malicious actor and updated to include harmful features. It had around 70,000 users at the time the malicious update surfaced, but researchers emphasize that not all users necessarily received this version. The extension was removed from the Chrome Web Store on August 14 after being flagged as potentially harmful.
The important takeaway is broader than just this one extension. It’s a realization that something you installed and relied on could change unexpectedly after an update. Understanding how this fake Chrome update scam operates, being able to spot warning signs, and knowing how to protect your computer is essential.
How the fake Chrome update scam works
Warnings can pop up while you’re on a regular website, using phrases like “Critical Update Required” or “Update available.” They usually direct you to download something before you can proceed.
However, Chrome typically manages updates within the browser itself, often doing so automatically. You can check for updates by opening Chrome and selecting More > Help > About Google Chrome.
If a webpage prompts you to download an unknown .vbs script or an unfamiliar .exe file to update Chrome, you should be suspicious. Google specifically advises against installing updates from unpredictable pop-ups and recommends visiting the official website instead.
Why a trusted extension can suddenly become dangerous
This scenario can catch even the most cautious users off guard. You might have installed an extension with thousands of users and positive reviews, using it for months without issue, and then it turns problematic.
Google has confirmed that it looked into the Enable Right Click & Copy – Smart Unlock + OCR and took action to safeguard its users, as reported by a Google spokesperson.
Recent research indicates that the threat went beyond mere fake update alerts, linking the extension to a larger scheme involving 19 Chrome and Edge extensions capable of launching harmful payloads. These included stealing credentials and draining cryptocurrency wallets, all originating from initially legitimate products that had been compromised.
The pattern is not new; earlier this year, researchers observed a similar incident where a popular extension was acquired and turned malicious. That specific extension had previously earned special recognition from Google before becoming problematic.
In hindsight, it raises my concern about trusting browser extensions entirely. A high rating reflects users’ past experiences but doesn’t ensure future updates won’t contain malware.
Why the 4.7-star rating should get your attention
This extension case also highlights an interesting point. Even as fake update warnings emerged, the Enable Right Click & Copy extension maintained an average rating close to 4.7 stars. This discrepancy can occur when earlier positive ratings skew the overall score.
Recent reviews, however, began to raise alarms about the fake Chrome update alerts. Users noted that disabling the extension eliminated the prompts.
So, it’s wise to investigate beyond the general star rating and pay attention to the latest reviews. I previously reported on a browser-extension scam involving a fake ad blocker that caused various issues and misled users into executing harmful commands.
Why antivirus software may not immediately explain the problem
A Reddit user encountering fake update warnings discovered that a full scan revealed nothing. They later linked the issue back to the suspicious extension.
A clean scan doesn’t necessarily mean a concerning browser warning is harmless. The extension might be the source of what appears on your screen. Moreover, a malicious file that has been downloaded could pose another risk if executed.
Google’s Safe Browsing system checks extensions and downloads against known threats, and can disable malicious extensions. However, new threats can sometimes bypass defenses momentarily, underscoring the importance of being vigilant about suspicious prompts.
This can happen outside Google Chrome
If you receive a Chrome-branded warning in another browser, it’s a good indication that something is amiss.
Users of other Chromium-based browsers, like Brave and Opera, have reported similar fake Chrome update prompts, often linked to dubious extensions rather than legitimate updates.
Since these browsers can support similar extensions, be cautious. If Opera unexpectedly indicates that Chrome needs an urgent update, it’s best to disregard that notification.
How to check whether Chrome really needs an update
You don’t need to trust random web pages to check your Chrome version. Simply:
Open Chrome > click the three-dot menu > Help > About Google Chrome.
This action will prompt Chrome to check for updates, and if a newer version is available, you’ll see an option to relaunch the browser. If it says you’re on the latest version, you can feel secure.
How to remove a suspicious Chrome extension
Take a close look at your installed extensions. Google allows you to temporarily disable an extension or delete it entirely. You can also assess what information each extension can access by reviewing its details.
If you have Enable Right Click & Copy installed, it may be best to remove it even if you haven’t clicked any suspicious downloads. Researchers uncovered harmful capabilities beyond just the fake update alerts. After removal, restart Chrome, run a comprehensive security scan, and change passwords for sensitive accounts using another secure device.
If you notice several unfamiliar extensions, disable them and only reactivate those you recognize and need. For detailed insights on identifying warning signs, CyberGuy offers a comprehensive guide on how to detect if your browser has been compromised.
How to stay safe from fake Chrome update scams
Here are a few smart practices that can help minimize your risk of falling for convincing scams.
1) Never update Chrome from a webpage pop-up
Close any pop-up that tells you to download an update. Instead, go directly to Chrome > Help > About Google Chrome. Be cautious with websites claiming you need to download software due to a supposed virus.
2) Use strong antivirus software
Reliable antivirus protection is essential in shielding your computer from malicious downloads. Opt for software that offers real-time protection to monitor incoming files for potential threats.
Keep antivirus software updated, as outdated programs can leave gaps in your defenses. If you accidentally downloaded a harmful file, conduct a thorough system scan and adhere to the program’s guidance for addressing any threats detected.
3) Review your browser extensions regularly
Take time every few months to check your installed extensions.
In Chrome on your computer:
- Open Chrome.
- Click the three-dot menu in the upper-right corner.
- Click Extensions.
- Click Manage extensions.
- Examine each extension listed and click Remove for anything you don’t use or recognize.
- To check an extension’s permissions, click Details beneath it.
- Look under Permissions and Site access to limit its access if necessary.
Be particularly wary of extensions that can change or read data on all the sites you visit, as they pose higher risks. If an extension suddenly asks for broader permissions or you’ve forgotten why you installed it, it might be best to remove it.
What to do if the fake Chrome update keeps appearing
If, after removing a suspicious extension, you still see the warning, continue troubleshooting.
- Start by disabling the remaining extensions one by one.
- Restart your browser after each change.
- Check for any unauthorized changes to your homepage or search settings.
- Then run a full antivirus scan with top-notch software.
- If the problem persists, you may need to consider the possibility of malware or browser hijacking.
- In such cases, avoid entering sensitive information until the device is secured.
Kurt’s key takeaways
This entire fake Chrome update scam reflects how insidiously such deceptions can unfold. You might have installed a reputable extension that worked fine for some time, only for it to change without warning. Therefore, it’s crucial not to disregard browser extensions after their initial installation; they need ongoing attention. The smaller the number of extensions you keep, the less exposure you invite. And remember: never download an update prompted by a web page. Check Chrome’s settings yourself—it could save you from a considerable security headache.
