How about explaining it better? Get them to show you a screenshot, and then you can point out the fact that it's not coming from code you served.
For a while, there was some very common malware that rendered my website unusable.
Perhaps that was a good thing, because it made you aware of its presence quickly.
You presume users understand what the difference is. Not all users are technical enough for that sort of thing.
Someone also points out a related problem: if the user complains on social media instead of directly to me. I don't always have the opportunity to explain at all.
> Perhaps that was a good thing, because it made you aware of its presence quickly.
Unfortunately, being aware of its presence didn't help much. I considered alerting the user that they had malware, but generally the only time a website tells a user they have malware is to scam a user (see: MacKeeper), and I didn't want users to see my site as untrustworthy.
https://github.com/Zarel/Pokemon-Showdown-Client/commit/95f2...
I wouldn't personally run something like this, but I've definitely experienced the frustration of having a user install an extension that changed my website, and then reported a bug in the extension to me.
Even when the extension is bug-free, it still adds a support burden. For instance, there's an extension that adds icons to usernames on my site. Users have asked me how to change their icon, and then gotten mad at me when I say I don't know.
It also adds a maintenance burden: Whenever I deploy various updates, I get complaints that the updates break one extension or another.
Not to mention, there are extensions not intentionally installed by users. For a while, there was some very common malware that rendered my website unusable. It added the text
But it did it badly, so it changed: to Which, of course, rendered my site unusable.