Malware and adware vendors have started showing up at the doors of extension authors looking to buy their extensions. The new owners can issue an ad-filled update over Chrome’s update service, which sends the adware out to every user of that extension. Ownership of a Chrome extension can be transferred to another party, and users are never informed when an ownership change happens. Injected ads are allowed in Chrome extensions, but Google’s policy states that which app the ads are coming from must be clearly disclosed.”]