https://cypher.codes/writing/intercepting-suspicious-chrome-...
- Note: my project specifically tries to protect users from Facebook hijacking and ad injection attacks - the two most common attacks on the CWS!
I once worked on a price comparison plugin and Firefox is very strict about what your plugins are allowed to do. They review each one and have some strict rules: like you can't load and execute Javascript from the web.
Most of our competitors just sent every URL you visited to their server. We wanted to be better than that since that is an obvious privacy issue.
So we made all our plugins (IE, FF, Chrome) download a whitelist (regex array) of shopping domains our search engine supported and it would only make API calls to our server if it matched that list AND you were on a product page.
Had the added benefit of reducing our server load too.
The server still gets a list of every page you visit on eCommerce sites but better than on all sites.
Footnote: I can't visit the page. Blocked by corporate.
You could, for example, exfiltrate data by injecting an image tag with some extra url parameters on the url. Doesn't have to be xhr or websockets.
people sell their high value extensions, then the new owners load them full of malware
chrome doesn't let you turn the updating off... I have previously resorted to removing update URL from the extension manifest manually...
I wrote some scripts to provide version pinning (just automates the manual editing of the manifests) but then you have to consider critical vulnerabilities in things like the LastPass extension where you absolutely want updates ASAP. So then you either have to have a curated extension list or maybe just separate extensions into "trusted" ie provided by reputable businesses as part of their product (lastpass, okta, etc) and "un-trusted." Even then, if the malware isn't in your face, you have no idea if the pinned version of your un-trusted extensions is actually non-malicious without auditing the code.
The ability of extensions to log form data to external servers allows for massive potential abuse. Not sure why Google would allow it. I imagine millions of logins have been stolen this way.
http://www.tomsguide.com/faq/id-2384484/enable-disable-chrom...
It's how SimilarWeb and other clickstream companies get their data. They claim it's harmless, but they have the ability to know everything you've inputted, and all the secure URL's you've visited (aka that intranet page with all your company salaries or passwords that you think nobody on the web knows about)
https://labs.detectify.com/2015/11/19/chrome-extensions-aka-...
