Chrome Extension Flagged as Malware: 7 Steps to Clear It

Originally published on ExtensionBooster.

When a Chrome extension gets flagged as malware by an antivirus, the first sign is usually a support email with a quarantine screenshot, not an alert from Google. The catch most developers miss: VirusTotal can't clear the detection for you. It only collects other engines' verdicts, so every vendor that flags your file has to be contacted one by one. Here is the order that gets users working again and keeps "it's a virus" reviews from sinking your rating.

How a false positive shows up

Watch for any of these signals:

• A user sends a quarantine notice naming a file such as background.js and a detection name.
• chrome://extensions tells users the extension "may have been corrupted" (Chrome can disable an extension when security software has modified its installed files).
• Your website or API domain gets blocked by a security suite, so every request from the extension fails.
• Several reviews mention a trojan or virus, often clustered in one region or one company.

A Zotero forum thread from May 2026 described EDR products flagging its Safari and Chrome extensions, and a Plasmo issue from April 2024 reported Windows Defender flagging a production build. Because frameworks and libraries are shared, one detection pattern can hit many extensions at once.

Steps 1 and 2: Prove it's false, then fingerprint the build

Don't file a single report until you have ruled out a real compromise:

1. Check the Developer Dashboard for versions you didn't publish, unknown team members, or changed contact details. If anything looks off, switch to incident response, not false-positive cleanup.
2. Diff the CRX that is live on the store against your own build output.
3. Ask the user for the exact detection name, file path and extension version.
4. If the flagged file is a vendor chunk, review recent lockfile changes for a poisoned dependency.

If the file matches your build, your account is untouched and the code does what you expect, treat it as a false positive. Then record a SHA-256 hash for every file in the unpacked package:

# Run from your unpacked build folder; keep the output with the release
find . -type f -print0 | sort -z | xargs -0 sha256sum > release-hashes.txt

That list proves to a vendor that the quarantined file is exactly what you published.

Steps 3 and 4: Find every engine and report to each vendor

Upload the flagged file to VirusTotal and write down each engine that flags it along with its exact detection name. One warning: VirusTotal uploads are not private. Reports are shared with its community and file contents can reach premium customers, so only upload files that are already public on the Chrome Web Store.

Then report to each vendor through its own channel:

Each report should carry the same facts: product name, store listing URL, extension ID, version, flagged file, its SHA-256, the detection name and engine, one or two sentences on what the file does, a source link and a support contact. Keep it to one file, one detection, one ticket. If the detection is heuristic, expect to resubmit after each release, because every new build produces new hashes.

Steps 5 and 6: Unblock your domains and your users

If your site or API is the thing being blocked, file a Google Safe Browsing error report, fix anything listed under Security Issues in Search Console and request a review. For other URL blocklists, use the same vendor channels as above and submit the URL instead of a file.

For users who are stuck right now, give them this sequence:

1. Update antivirus definitions, in case the vendor has already fixed the detection.
2. Click Repair on chrome://extensions.
3. On managed machines, ask IT to allowlist %LocalAppData%\Google\Chrome\User Data (or the Edge equivalent).

Never tell people to turn off their antivirus. Also ask which security software they run: an October 2025 Chromium Extensions thread describes a known race in content verification, so not every "corrupted" report comes from antivirus.

Step 7: Protect your rating while you wait

• Answer every malware review with facts: name the vendor, mention the open ticket, link a status page and promise a follow-up.
• Publish a short status note listing affected versions, detection names, hashes, contacted vendors and user steps.
• Close the loop: once a vendor clears the file, update your review replies and email the affected users.
• Keep fresh reviews coming in. Google's August 2026 Chrome Web Store update says ratings will focus on more recent reviews, so a steady flow of new feedback limits how long a bad week drags your average.

To make the next detection faster to clear, don't obfuscate (minification is allowed under the code readability policy), keep remote code out as Manifest V3 requires, ship source maps or a public repo, and watch reviews and support mentions for 48 hours after every release.

Key takeaways

• Rule out a hijacked account or poisoned dependency before calling anything a false positive.
• Hash every file in each release so you can prove what you shipped.
• VirusTotal aggregates verdicts; only each vendor can remove its own detection.
• Give users a safe path: updated definitions, Repair, or an IT allowlist.
• Reply to "virus" reviews with facts and follow up when the detection is gone.

The original post includes a ready-to-use vendor submission template and FAQ: see the full guide to clearing an antivirus false positive on a Chrome extension. For more on ratings and reviews for extension and app developers, visit ExtensionBooster's growth platform for extension developers.

Has an antivirus ever flagged your extension or app, and which vendor took longest to clear it?