I feel like this is gonna be a new trend. From Threatpost:

The number of compromised Chrome browser extensions is growing beyond the initial Aug. 1 hijacking of the OCR add-on called Copyfish. Added to list are seven additional legitimate Chrome Extensions that attackers took over and used to manipulate internet traffic and web-based ads, according to researchers at Proofpoint.

I first realized that Chrome extensions are a legit vector for Malware after watching my father installing an extension that asks for “Access to all the website that you visit” without even thinking about it. It’s similar to early Android, in which permissions are wide open.

Chrome revolutionized the way browser handles web by introducing the concept of sandboxing. Unfortunately extensions permission-based security, with the majority of users unaware or simply doesn’t care, break all of this. Time for Google to act.