Product record · MetaMask
MetaMask Browser Extension
Original MetaMask browser-wallet product.
- Launch
- 2016-07-14
- Sales
- not_applicable
- Support
- supported
- Variants
- —
- Confidence
- high
- Last verified
- 2026-09-10
Material concerns
Custody and recovery assumptions
Active support, evidence verification, or product type is not a safety endorsement. Missing custody or recovery metadata is shown as unknown rather than inferred as self-custody.
- Custody model
- self_custody
- Key-management model
- software_key_vault
- Independent recovery
- Unknown / requires evidence review
Lifecycle
Product timeline
First MetaMask version shipped
Product: MetaMask Browser Extension
MetaMask shipped its first public browser-wallet version.
MetaMask Extension critical clickjacking vulnerability disclosed
Product: MetaMask Browser Extension
MetaMask reported a critical Extension-only clickjacking vulnerability that could render the wallet UI as a hidden layer over a malicious site and trick users into revealing private data or sending crypto-assets. MetaMask awarded the reporting team a $120,000 bounty and stated that Extension 10.14.6 and later were protected.
Demonic vulnerability exposed MetaMask Extension recovery phrases on disk
Product: MetaMask Browser Extension
Halborn disclosed CVE-2022-32969, known as Demonic, in which browser session-restore behavior could cache an imported Secret Recovery Phrase to disk in plaintext under specified conditions. MetaMask Extension versions before 10.11.3 were affected; MetaMask implemented mitigations in 10.11.3 and later, and MetaMask Mobile was not affected.
Consensys Software Inc. announced its rebrand as MetaMask and business separation
Consensys Software Inc. announced that it would continue as the same company under the MetaMask name, focused on the consumer platform, while its protocols and institutional infrastructure business would become a newly formed company carrying the Consensys name. Completion of the separation was expected by the end of 2026, and MetaMask said users' app, assets, keys, and access were unchanged at announcement.
Sources