The Chrome Update Pop-up May Actually Be Malware.
If you’re seeing pop-ups in Chrome asking you to download an update to continue browsing or avoid losing access to your data, you may be a victim of malware. As Android Authority reports , compromised browser extensions appear to be distributing malicious scripts disguised as “critical” security updates.
Hackers use malicious extensions to distribute fake security updates.
Some Google Chrome users have noticed intrusive pop-ups warning about the need for updates and prompting them to download the latest version of the browser. One of them states that “access to websites is temporarily blocked” until the update is installed. Another pop-up is even more urgent, stating that Chrome will stop working after a certain date and will require a “complete reinstall,” which could result in users losing access to bookmarks, history, and saved passwords. Clicking “Update Chrome” will download a suspicious .vbs or .exe script to your device.
The issue appears to be related to several extensions that load malicious scripts and display fake pop-ups in the browser. In Chrome, one such extension is “Enable Right Click & Copy Smart Unlock + OCR,” which is rated “Recommended” and has 70,000 downloads (though other tools may be the culprit). Users of Brave and Opera, both Chromium-based browsers, reported identical pop-ups. In the former case, the compromised extension, called “QuickLens – Search Screen with Google Lens,” was removed from the Web Store.
While some malicious add-ons do make it into the Chrome Web Store, attackers often weaponize seemingly harmless extensions, gaining platform approval and user trust. In campaigns detected in Chrome, Microsoft Edge, and Firefox, hackers created extensions masquerading as crypto wallets and productivity apps, allowed them to operate legitimately to gain numerous downloads and reviews, and then distributed updates that transformed them into malware.
This is an effective strategy because malicious extensions can evade detection by antivirus software and system scans. The browser itself isn’t compromised; rather, the extension downloads malicious scripts from a remote server, and the threat is only detected after you actually download and run them on your device.
Do not download security updates from pop-up windows.
If your browser starts displaying pop-ups warning you about critical security updates, don’t click them, copy, or install any of them. These notifications use fairly compelling Chrome branding, along with elements like copyright notices, links to the privacy policy, and terms of service, but beware of unnecessary urgency. You can check whether your browser truly needs an update in the settings menu (in Chrome, click the three vertical dots or go to Settings > About Chrome ).
You should also regularly check your browser extensions and remove any unnecessary ones. Click the Extensions icon > Manage Extensions to see which extensions are active and check the permissions they’ve granted. If pop-ups still appear, try removing the associated apps to determine the cause of the problem.