2 ms·
So you can test the "exploit" obviously.
by okanesen 9y ago
So you can test the "exploit" obviously.
- orliesaurus 9y agoyes obviously, but in a real world scenario how would that work? Malicious extension loads the CSS file in my current tab and sniffs my password on the attacker's server? Can Chrome extensions load CSS without me having to click/activate them?
- maxchehab 9y agoYes they can. This attack does not have to be carried done through a chrome extension. I simply chose that because it is the easiest to show off. This can be hidden inside of a malicious npm module or injected into a website that has poor input sanitization. The most important aspect of this attack is that it is carried out through css. It is possible to block remote javascript code from an extension, in fact, if one wanted to inject javascript into https://instagram.com https://instagram.com (my example on github), they would fail.
- orliesaurus 9y agoThanks OP - that answers it!
- bfred_it 9y agoThe extension is just a way to inject this demo into any site, but extensions that you install can run JavaScript in any site they're allowed to, so this "hack" isn't necessary in that case.