More than 100,000 Chrome users have complained to Google about extensions injecting ads into their browser windows since January 1, 2015 alone, and now The Chocolate Factory is moving to block the worst offenders.
Ad injectors are extensions – or occasionally standalone apps – that replace native advertising on web pages with whatever the software's creator wants you to see. They can range from being simply annoying to a serious security risk, as was seen in the Lenovo Superfish debacle.
"Unwanted ad injectors aren't part of a healthy ads ecosystem. They're part of an environment where bad practices hurt users, advertisers, and publishers alike," said Nav Jagpal, a software engineer for Google's Safe Browsing program.
To investigate the issue, Google commissioned a survey from the University of California Berkeley, which cranked through data from over 100 million page views of Google websites. The final results will be released on May 1, but Google has already published some of the details.
The researchers found ad injectors on both operating systems tested (Windows and OS X) and in the Chrome, Internet Explorer, and Firefox browsers. While most injectors just pushed advertisements, 34 per cent were also pushing malware onto user's systems.
Around 5 per cent of visitors to Google sites had at least one ad injector installed. Of those, 50 per cent actually had more than one running, while one third of those visitors had four or more ad injectors subverting their browser.
The Berkeley team found 192 "deceptive Chrome extensions" affecting 14 million users, which Google has now barred from operation. It's also now using techniques identified in the report to find similar software that breaks Google's terms and conditions.
Google isn't planning to get rid of all ad injectors, however. If the software tells the user exactly what it's doing and it doesn't interfere with website-specified advertising, then the Chocolate Factory will show some leeway.
But Mountain View will be dissuading people from installing ad-injecting software from rogue sites. If a program hosted on a site doesn't use the right APIs to interact with browsers, then Chrome will display a message warning users away from the site.
Google said it will also use new information gleaned from the Berkeley study to scan current and future Chrome extensions to make sure ad injectors are kept to a minimum, where possible. ®
Sponsored: Ransomware has gone nuclear