Firefox PDF‑Viewer Add‑On Found to Harvest Google Session Tokens

A Firefox add‑on marketed as a utility for opening protected PDF files has been identified as a conduit for stealing Google account sessions. Security researchers discovered that once the extension is installed, it can turn a browser that is already signed into Google into a pathway for attackers to hijack the account without the user’s knowledge.

The malicious code is deliberately lightweight. During the initial review it contains only the functionality needed to download additional instructions from a remote server after the user clicks “Add to Firefox.” This delayed‑fetch technique leaves little suspicious script for automated scanners or manual reviewers to flag, allowing the extension to pass Mozilla’s add‑on store checks.

Once the secondary payload is retrieved, the extension extracts the authentication cookies that Google uses to maintain a logged‑in session. Those cookies are then transmitted to a command‑and‑control endpoint, where an attacker can reuse them to impersonate the victim on services such as Gmail, Drive and Calendar. Because the theft occurs at the session level, no password is required and two‑factor verification is bypassed.

The episode highlights a growing trend in browser‑extension abuse, where developers hide malicious behavior behind legitimate‑sounding names and defer the download of harmful components until after installation. Similar schemes have been observed in both Chrome and Edge ecosystems, prompting security experts to call for more dynamic analysis of extensions and stricter vetting of post‑install network requests.

Mozilla has responded by removing the add‑on from its catalog and issuing a warning to users to uninstall any copies they may have added. The company also said it will review its policies on delayed code loading and consider additional safeguards. Users are advised to install extensions only from trusted developers, regularly audit their add‑on list, and monitor active sessions in their Google account security settings.