A Chrome extension that shows Bitcoin prices and lists 50,000 users is up for sale at $55,650. The listing does not document a completed sale or tie the product to malware. Still, earlier security reports show that buying an established extension can hand a new owner control of its future updates.
Google's Chrome Web Store lists 50,000 users for Bitcoin Price Tracker, an extension advertised for $55,650. The offer includes the published product, its source code and 14 days of handover assistance.
The seller listed it on Sept. 29 and separately reports 37,100 installs from Sept. 14, 2025, through Sept. 13, 2026. However, the advertisement does not document a completed transaction or connect the product or its seller to malware.
Edge ownership transfers can precede public changes
A sale matters because a new owner can direct future updates. Microsoft says that after an Edge transfer, the new owner gains full control over the extension's listing and updates.
Yet the public listing does not necessarily change at the same moment. Microsoft says changes to the description, screenshots, privacy-policy URL, owner name and website link do not automatically appear when ownership transfers, and the previous information stays visible until the new owner publishes an update. The source does not assert this Edge behavior for Chrome.
Security firms documented malicious updates after purchases
In an Aug. 27 investigation, Socket identified 19 malicious extensions, 18 for Chrome and one for Edge. It classified 14 as created by the attacker and five as bought from legitimate authors.
According to Socket, the acquired products first worked as advertised, and later versions added malicious behavior. Socket described fake Ledger and Trezor recovery interfaces designed to collect seed phrases, plus wallet-connection and swap hijacking in one acquired extension.
Annex reported a case involving the QuickLens image-search extension. A new owner appeared on Feb. 1, and a malicious version 5.8 followed 16 days later. Annex said the update added permissions that would trigger an acceptance prompt, while the original function kept working.
Socket's Superior tracker, as viewed on Nov. 13, labels the campaign "Ongoing" and records 33 affected package artifacts representing 24 unique packages. The current sale offers remain separate from those confirmed cases, and Socket recommends regularly reviewing extensions and removing unnecessary or suspicious ones.
Source: CryptoSlate
Trading involves risk.
Risk Disclaimer
