Yes. Compromised extensions auto-update in the background.

The question doesn't say which extension it means. Across well-documented incidents (Cyberhaven, ShadyPanda, RedDirection), the pattern is the same. Attackers take over a developer account or buy a popular extension, then push a malicious update through the official store. Browsers install it in the background without asking, which is why these attacks spread so widely. If you mean one particular incident, the exact details, such as timing and version, would need to be checked against that incident's report. Some managed or locked-down browsers can delay or block updates, but default behaviour is silent auto-update.

• Chrome and Edge update installed extensions in the background by default, and users are usually not prompted.
• The ShadyPanda campaign (reported by Koi Security) affected about 4.3 million users through silent updates to 145 Chrome and Edge extensions.
• The RedDirection campaign involved 18 extensions with more than 2.3 million users, and the malicious versions installed automatically.
• The Cyberhaven Chrome extension was compromised in late 2024 after a phishing attack on a developer account. The malicious update reached users automatically and was live for about 24 hours.
• The main exception to silent updating is an update that requests new permissions, which can prompt the user.

1. Malicious browser extensions: how malicious extensions steal browser data, and how to detect and block them pushsecurity.com
2. ShadyPanda malware campaign turned Chrome and Edge extensions into spyware foxnews.com
3. Malicious Browser Extensions: How to Find and Remove Them huntress.com
4. Millions of Chrome, Edge users compromised with malicious extensions scworld.com
5. Browser extensions turn Trojan and infect 2.3 million Chrome and Edge users cybernews.com
6. What happens when a trusted browser extension is replaced with a malicious version? nhimg.org
7. Why browser extensions are a major security risk and what you can do about it aikido.dev
8. Browser Extensions Turned Trojan Overnight, Compromising 2.3 Million Users - Security Spotlight dailysecurityreview.com

Whether a malicious update reached users automatically depends on the particular extension and incident. Evidence about other compromised extensions would not establish what happened in this case.

1. darktrace.com
2. keepaware.com
3. grc.com
4. cyberdefenders.org
5. blog.naol.dev
6. arxdsilva.com
7. extensionauditor.com
8. github.com

In the October 29, 2026 supply chain incident involving the Claude Code extension in Cursor, the malicious build was served directly under the extension's legitimate identifier. Because editors derived from VS Code, including Cursor, enable background extension auto-updates by default, machines running the software pulled and installed the backdoored release automatically during the roughly 11-hour exposure window.

• On October 29, 2026, a tampered build of the Claude Code extension (versions 2.1.312 and 2.1.313) appeared on Cursor's extension marketplace.
• Cursor's default editor settings automatically check for and apply extension updates in the background without requiring user intervention.
• Cursor disclosed that up to 5,000 developer machines were exposed to the malicious update during an 11-hour distribution window.
• The malicious payload executed upon loading, attempting to install persistence and open a reverse SSH backdoor.

The claim describes the delivery mechanism of compromised extensions, and the incident record supports it directly: in each documented case the malicious version was published to the official store and pushed to existing installs through the extension's normal automatic update. The main exception is users or organisations who have disabled extension auto-updates or pinned versions, and stores sometimes pulled malicious versions quickly — but that does not change how the compromised code reached the machines that received it.

• Koi Security's ShadyPanda report (December 2025) describes roughly 4.3 million users of Chrome and Edge extensions that were flipped to spyware through silent updates after years of legitimate operation.
• Cyberhaven's Chrome extension was trojanized on 24 December 2024 and version 24.10.4 auto-updated on machines whose users had installed it, exfiltrating session cookies and access tokens.
• A trojanized Nx Console VS Code extension was live on the Visual Studio Marketplace for about 18 minutes on 18 May 2026; machines with the extension installed or set to auto-update received the credential stealer, which GitHub linked to a breach of about 3,800 internal repositories.
• A trojanized Claude Code extension build (2.1.313) sat in Cursor's marketplace on 29 October 2026 and was delivered to up to 5,000 developers as a routine auto-update, adding an SSH backdoor.
• Browser and IDE extension updates run automatically by default, which is why attackers use this channel rather than asking users to install anything.

1. A Browser Extension Risk Guide After the ShadyPanda Campaign thehackernews.com
2. Malicious Chrome Extension Supply Chain Attacks Explained safeguard.sh
3. ShadyPanda Malware Patiently Spread Across Edge And Chrome Web Store For Years Before Activating - PC Perspective - ShadyPanda Malware Patiently Spread Across Edge And Chrome Web Store For Years Before Activating pcper.com
4. GitHub Internal Repositories Breached via Malicious Nx Console VS Code Extension - GitHub Internal Repositories Breached via Malicious Nx Console VS Code Extension securityboulevard.com
5. Trojanized Claude Code Extension Hit Up to 5,000 Cursor Users | AI Weekly aiweekly.co
6. browser extension - X-Industry redskyalliance.org

The claim is directly supported by multiple sources from 2026, which confirm that browser extensions auto-update in the background by design. This feature, intended to ensure users receive security patches and new features, has become a significant attack vector. Attackers exploit the auto-update mechanism by acquiring popular extensions, compromising developer accounts, or hijacking the update channel to deliver malicious code to existing users without their knowledge or consent. The evidence is strong and consistent across multiple reports, including specific examples of extensions that were compromised and auto-updated to include malicious functionality.

• Browser extensions auto-update in the background without user interaction, even if the extension's ownership changes.
• In 2026, multiple documented cases show compromised extensions delivering malicious updates via this auto-update mechanism.
• Attackers acquire popular extensions or compromise developer accounts, then push malicious updates to existing users.
• Examples include the AI Sidebar extension (July 2026) and the QuickLens extension (February 2026), both of which auto-updated to include malicious payloads.
• Enterprise security teams and users are advised to treat browser-stored credentials as compromised if a known malicious extension was installed.

1. The Extension You Vetted Is Not the One That Auto-Updates - DEV Community dev.to
2. Chrome Extension Supply Chain Attack: Crypto Theft 2026 decryptiondigest.com
3. Browser Extensions Are the Biggest Security Hole in 2026 - Sendwin blog.send.win
4. Malicious Browser Extensions: Threats & Audit Guide guard.io
5. r/cybersecurity on Reddit: I noticed weird console.logs firing on every site — turned out a Featured Chrome extension got sold and was running a full malware chain on my machine reddit.com
6. Fake Chrome update scam tied to malicious browser extension, warns Google | Fox News foxnews.com
7. Malicious Browser Extensions: Detect And Remove In 2026 - Making Sense Of Security makingsenseofsecurity.com
8. A trusted browser extension can turn malicious after an ownership change - Quest Review Center questreviewcenter.com