the avast online security browser extension

Instead, McAfee recommends you use Internet Explorer, and will helpfully remove Edge from your taskbar and pin Internet Explorer there if you let it. It has a more streamlined codebase and a variety of other improvements, such as protection against “ binary injection,” where other programs inject code into the Microsoft Edge process.Īnd yet, McAfee–which is even installed by default on many new Windows 10 PCs–really doesn’t want you to use Microsoft Edge. It runs in a sandbox and abandons support for old, insecure plug-in technologies like ActiveX. If you’ve been following the development of Microsoft Edge for Windows 10, you’ll know that it’s supposed to be a more secure web browser than Internet Explorer. Example 2: McAfee and Norton Don’t Think Microsoft Edge Is Secure (Because It Doesn’t Support Their Add-On) Hopefully, the browser extensions are being developed by a different team and the real experts are working on the antivirus software itself–but that’s a good example of how those antivirus browser extensions can go from useless to harmful.

Not only did AVG ship a browser extension with obviously broken, shoddy, insecure code, but AVG’s developers couldn’t even fix the problem without having their hands held by a Google security researcher. The fix restricts the functions to two specific AVG domains, but, as Ormandy noted, the websites on those domains have their own flaws that opens users up to attack. As Ormandy wrote: “AVG submitted an extension with a “fix”, but the fix was obviously incorrect.” He had to provide instructions for how to fix this flaw, and AVG issued an updated patch a day later. “I hope the severity of this issue is clear to you, fixing it should be your highest priority.”įour days after it was reported, AVG had a patch. “My concern is that your security software is disabling web security for 9 million Chrome users, apparently so that you can hijack search settings and the new tab page,” he wrote to AVG. AVG’s official description of the extension says it will “warn you of unsafe search results.”īack in December, Google-employed security researcher Tavis Ormandy discovered that the extension adds a large number of new JavaScript APIs to Chrome when it’s installed and that “many of the APIs are broken.” Aside from exposing your entire browsing history to any website you visit, the extension offered many security holes for websites to easily execute arbitrary code on any computer with the extension installed. According to the Chrome Web Store, it has nearly 10 million users. “AVG Web TuneUP” is installed when you install AVG antivirus. RELATED: Beware: Free Antivirus Isn't Really Free Anymore Example 1: AVG Web TuneUP Broke Chrome’s Security

The avast online security browser extension