PSA: Don’t trust that Chrome update popup — it could be malware

Affiliate links on Android Authority may earn us a commission. Learn more.

We all have our favorite Chrome extensions that make daily web browsing effortless, whether it’s a quick screen snip tool, a right-click unlocker, or a simple tab manager. But what happens when one of those trusty add-ons quietly turns against you? Over the past few days, an increasing number of web users have fallen victim to a frustratingly convincing browser scam that tricks people into downloading harmful malware disguised as routine system updates.

The issue manifests as an aggressive pop-up claiming a “Critical Update Required” or “Update available” to keep using your browser. If you click to proceed, instead of a standard browser update, it downloads a suspicious .vbs or .exe script directly to your machine.

As one frustrated user reported on Reddit , traditional antivirus software like Malwarebytes often fails to flag anything during full system scans. That is because the browser itself isn’t infected; rather, an extension you installed is dynamically fetching malicious scripts from an external server to trigger the fake notification inside your browser session.

What makes this attack vector particularly insidious is that it isn’t isolated to Google Chrome. Users on alternative Chromium platforms like Brave and Opera are reporting identical pop-ups asking them to update Chrome, a dead giveaway of a rogue script at play. In a thread on the Brave Community forum from earlier this year, affected users traced these occurrences back to a compromised utility known as QuickLens – Search Screen with Google Lens, which was eventually pulled from the Web Store.

In more recent reports, users pinpointed extensions such as “Enable Right Click & Copy Smart Unlock + OCR” and various utility helpers as the culprits behind the fake update prompts. The extension is still live on the Chrome Web Store, has 70,000 downloads, and a 4.7/5 rating, meaning most users love it.

It’s not uncommon for bad actors to buy out previously legitimate extensions or wait for developer accounts to change hands. Once acquired, they push silent updates that bypass initial Web Store checks. Because the extension itself acts only as a doorway that pulls malware assets from remote servers on demand, traditional antivirus software rarely catches the threat until a user manually executes the downloaded file.

If you start seeing these persistent update demands on your desktop, avoid clicking any links or running downloaded files. Instead, check your browser’s native settings menu to see if an update is legitimately pending. If the pop-ups continue, I strongly recommend auditing your active extensions and disabling them one by one, prioritizing recent downloads or niche productivity utilities until the fake prompts vanish for good.