NEEDED: Bring your own laptop with a chromium-based browser with internet connectivity. Additionally, people who want an isolated environment can have a VM setup with internet connectivity and a Chromium-based browser installed on it. In today's interconnected digital world, an internet browser is a ubiquitous tool that facilitates many online activities, from shopping to booking services and streaming entertainment. The advent of browser extensions has dramatically enhanced this user experience, providing add-ons that increase productivity and offer convenient features such as AD Blockers, VPNs, AI-integrated chatbots, and digital wallets. However, this rise in demand for feature-rich extensions also represents an opportunity for nefarious actors. A seemingly benign extension, once installed, if malicious, can conduct a range of activities from spamming ads, crypto-jacking to keystroke logging and even impersonating the user. During our workshop, we'll dive into the intricacies of browser extensions, understanding permissions, and the evolution from Manifest V2 to V3. While MV3 offers notable enhancements, it's not immune to exploitation by adversaries, presenting risks to user privacy and security. Participants will get an overview of various attacks that can be performed by malicious extensions, such as session hijacking, camera and microphone access, browser fingerprinting, data interception, and many more. To provide a practical perspective, we'll conclude with a live demonstration, analyzing sample malicious extensions. This session aims to deepen your understanding of browser extensions and the associated safety concerns.