3 ms·
Why do you have to activate the extension before entering the password?
by orliesaurus 9y ago
Why do you have to activate the extension before entering the password?
- guntars 9y agoProbably to add the css file to the page you're on.
- okanesen 9y agoSo you can test the "exploit" obviously.
- orliesaurus 9y agoyes obviously, but in a real world scenario how would that work? Malicious extension loads the CSS file in my current tab and sniffs my password on the attacker's server? Can Chrome extensions load CSS without me having to click/activate them?
- maxchehab 9y agoYes they can. This attack does not have to be carried done through a chrome extension. I simply chose that because it is the easiest to show off. This can be hidden inside of a malicious npm module or injected into a website that has poor input sanitization. The most important aspect of this attack is that it is carried out through css. It is possible to block remote javascript code from an extension, in fact, if one wanted to inject javascript into https://instagram.com https://instagram.com (my example on github), they would fail.
- orliesaurus 9y agoThanks OP - that answers it!
- bfred_it 9y agoThe extension is just a way to inject this demo into any site, but extensions that you install can run JavaScript in any site they're allowed to, so this "hack" isn't necessary in that case.