Coinbase Wallet Extension in 2026: Official Status, Features, and Critical Security Warnings
The Coinbase Wallet extension remains available and actively maintained in the Chrome Web Store, but users must navigate a landscape complicated by a major brand transition, aggressive phishing campaigns, and a critical distinction between the custodial exchange and the self-custody wallet. As of October 2026, the extension is at version 3.149.0, published by Toshi Holdings Pte. Ltd., and serves as a non-custodial gateway to decentralized finance, NFTs, and Web3 applications across Ethereum, EVM-compatible networks, and Solana . However, the mobile application formerly known as Coinbase Wallet was rebranded to “Base App” in July 2025, creating potential confusion about which product is which and where official downloads should come from .What the Extension Actually Does
The Coinbase Wallet extension is a self-custody wallet, meaning private keys are stored locally on the user’s browser rather than on Coinbase’s servers. This is fundamentally different from a Coinbase.com account, which is a custodial brokerage service where Coinbase holds the assets . The extension supports connecting to thousands of decentralized applications across Ethereum and all EVM-compatible networks, including Avalanche, Polygon, and BNB Chain. It also supports sending and receiving Solana and SPL tokens . Users can manage NFTs, trade tokens on decentralized exchanges, and interact with DeFi protocols directly from the browser interface. The extension is available for Chrome, Brave, and Firefox. Official setup documentation instructs users to create a new wallet or import an existing one using a 12-word Secret Recovery Phrase. Crucially, Coinbase explicitly states that it cannot recover this phrase or the wallet password for users—loss of the phrase means permanent loss of access . The extension also supports importing wallets from MetaMask, Trust Wallet, and the Coinbase Wallet mobile app (now Base App), and can connect to Ledger hardware wallets for enhanced security .The Base App Rebrand and What It Means for Extension Users
In July 2025, Coinbase rebranded its mobile wallet application to “Base App,” signaling a strategic shift toward positioning Base as a standalone ecosystem identity . The Base App has since expanded to include a browser extension and web access, multi-chain trading across Ethereum, Solana, and BNB Chain, and tokenized asset markets. It also offers USDC rewards of up to 3.35% APY in selected regions . This creates a naming ambiguity that users must understand. The “Coinbase Wallet extension” in the Chrome Web Store is still the self-custody browser wallet associated with the Coinbase Wallet brand. However, on mobile, the equivalent product is now called Base App. A tutorial from 2026 notes that users looking for the mobile wallet should search for “Base App” from the verified Coinbase developer rather than “Coinbase Wallet” . For desktop browser users, the Chrome Web Store listing remains the primary official distribution channel.Active Phishing Campaigns Targeting Coinbase Wallet Users
The most urgent information for anyone searching for the Coinbase Wallet extension is that phishing operations specifically impersonating it are active and have been flagged by multiple security vendors. A domain registered in February 2026,public--coinbase-wallet-extension.pages.dev, was flagged by 15 out of 15 VirusTotal security vendors as a phishing site targeting Coinbase users. It was designed to mimic the official extension download page and harvest credentials or wallet keys . Another domain, coinbasextension.vercel.app, was identified as an active crypto drainer with cloaking technology that served different content to security scanners versus real visitors, and was flagged by 11 out of 95 VirusTotal vendors including Kaspersky and ESET . A third domain, coiinbasewalleetextension.webflow.io, used a typo-squatted name and was taken down within 12 hours of reporting after being flagged by 17 security vendors .
Beyond fake websites, a more sophisticated threat was disclosed by HP Wolf Security in September 2026. A campaign called “TradingClaw” advertised a fake AI crypto-trading agent and delivered malware called Needle Stealer through a Windows executable falsely presented as Microsoft-signed. Once installed, the malware replaced legitimate browser wallet extensions—including Coinbase Wallet, MetaMask, and Phantom—with malicious copies that captured passwords entered through counterfeit interfaces and sent them to attacker-controlled servers . This means that even users who originally installed the legitimate extension could have it silently replaced by malware if they downloaded the fake trading software.