Avast and AVG Extensions Found Spying On Chrome and Firefox Users

Mozilla has removed four Firefox extensions offered by Avast and its subsidiary AVG over reports of snooping on users’ browsing histories and collecting user data.

These four extensions are Avast Online Security, AVG Online Security, Avast SafePrice, and AVG SafePrice.

For those unaware, when you install Avast and AVG antivirus software, it also installs their respective Firefox and Chrome extensions listed above. For instance, the Avast and AVG Online Security extensions alert users when navigating to unknown malicious or suspicious sites.

On the other hand, SafePrice extensions help online shoppers learn about better prices, deals, and available coupons at other sites.

While these extensions certainly appear helpful, they were caught snooping on user’s browsing habits in October this year.

Wladimir Palant, the creator of the AdBlock Plus ad-blocking extension, found that the Avast Online Security and AVG Online Security extensions were collecting much more data than they are intended to, including detailed user browsing history.

This data includes the full address of the page, the page title, the referer URL, a unique user identifier (UID), your OS version, your country code, browser name and its exact version number, whether you previously visited the page, and other information.

“The data collected here goes far beyond merely exposing the sites that you visit and your search history. Tracking tab and window identifiers as well as your actions allows Avast to create a nearly precise reconstruction of your browsing behavior: how many tabs do you have open, what websites do you visit and when, how much time do you spend reading/watching the contents, what do you click there and when do you switch to another tab. All that is connected to a number of attributes allowing Avast to recognize you reliably, even a unique user identifier,” Palant said.

Palant concluded that the collecting of data was not an oversight.

On October 28, Palant published a blog post detailing these findings. However, the same snooping behavior was found in the Avast and AVG SafePrice extensions as well, about which Palant wrote in a blog post dated December 3.

Since Palant’s original blog post didn’t manage to catch the attention of the browser makers, he reported the extensions to Mozilla developers on December 2.

An Avast spokesperson told ZDNet that they are working with Mozilla “to resolve the issue.”

“The Avast Online Security extension is a security tool that protects users online, including from infected websites and phishing attacks,” an Avast spokesperson added. “It is necessary for this service to collect the URL history to deliver its expected functionality. Avast does this without collecting or storing a user’s identification.

“We have already implemented some of Mozilla’s new requirements and will release further updated versions that are fully compliant and transparent per the new requirements. These will be available as usual on the Mozilla store in the near future.”

Meanwhile, Mozilla has quietly removed the Avast Online Security, Avast SafePrice, AVG Online Security, and AVG SafePrice extensions from the Mozilla add-on repository.

Users trying to visit the pages are now greeted with an “Oops! We can’t find that page” with details about what may have happened to the extension.

But, the four extensions are still available on the Chrome Web Store [1, 2, 3, 4], despite Palant reporting them to Google. But, he believes that Google will remove these extensions after “considerable news coverage.”

Additionally, Palant has also found the add-ons on Opera Add-ons site for which he has sent a report to Opera.