10 ms·

More malicious extensions in Chrome Web Store

216 points by campuscodi 3y ago

kevingadd 3y ago
This will continue to get worse until Google takes security seriously on the Web Store. They don't meaningfully review uploads and they don't seem to staff it well in general - they take a very long time to process DMCA-related stuff, and when they do flag something for review (VERY rare) the review can take a very long time. Maybe it's unreasonable for me to expect them to invest money into running their "Store" but maintaining a reasonably popular extension for a while gave me a very low opinion of the whole service. I always have gotten the impression that the Chrome Web Store is something they'd rather get rid of if extensions (especially ad blockers) weren't a necessary evil to maintain their market dominance in browsers. The install and update UX have always been kind of neglected and awkward, and the permissions model is bad. Manifest V3 "fixes" some of this, I guess. As of today if I go to the chrome web store and try to install the recommended extensions on the front page, all of the ones I checked need to "read and change all my data on all websites" in order to do things like add a context menu option or run a connection speed test. There's no way for an ordinary user to tell the difference between "Chrome's permission model is garbage so every extension asks for this horrible permission" and "This extension is malicious and is actually going to read/change all my data"
- Larrikin 3y ago
  Have you tried Firefox?
  - kevingadd 3y ago
    I've been using Firefox since 1.0, yes. I still end up needing a Blink-based browser installed to do my day job and access government websites, though, which means Edge or Chrome.
- yjftsjthsd-h 3y ago
  > They don't meaningfully review uploads and they don't seem to staff it well in general Well, yeah; it's Google. Their entire approach to anything resembling support is to automate everything that can be automated, and utterly ignore anything that can't be.
- tyingq 3y ago
  The current plan just seems to be to progressively reduce the functionality of extensions to the point that they don't do anything useful.
- mbreese 3y ago
  Are you surprised though? The Chrome Web Store isn't really a store... it's not like Chrome can (or does) charge for extensions. The only ones that are commercial that I'm aware of are tied to external systems (password managers, note taking, etc), and it's not like Google gets a cut from that. So the store will always be a cost center with net-negative revenue. Knowing this, how could they realistically review anything manually? The only model that has had some success in this regard has been the Apple App Store, which routinely gets vilified for it's walled garden. I'm not sure what the answer is here, but I'd pay extra for a more secure extension "store" for the (few) extensions that I use. Or pay more for the products I already pay for that provide extensions (1Password, Zotero, Pocket, etc...). But that would be a rounding error for Google's revenue, so I'm not holding my breath...
anilshanbhag 3y ago
I am the developer of Voice In (https://chrome.google.com/webstore/detail/voice-in-speech-to-text-d/pjnefijmagpdjfhhkpljicbbpicelgko?hl=en https://chrome.google.com/webstore/detail/voice-in-speech-to...), a Chrome extension with 300k+ users. Every month, I have 2-3 folks reach out asking for one of two things: 1) Something something Bing. Here is one from two days ago - https://imgur.com/a/KOwLRIC https://imgur.com/a/KOwLRIC 2) They want anonymized web browsing data. Google just yesterday sent out an email cracking down on this. From the email: To better protect users' browsing experience, the Quality Guideline changes clarify that an extension's purpose is to provide complimentary functionality for the browsing experience and should not seek to hijack a user's browsing or search experience. This update aims to ensure that users have full control over their browsing sessions, without any unwarranted interruptions or manipulations. By enforcing this policy, we strive to foster a safer and more enjoyable environment for all Chrome users, where their trust and satisfaction remain our top priorities. Together, we can create a web ecosystem that respects users' autonomy and offers seamless browsing experiences that truly enhance their lives.
- userbinator 3y ago
  Together, we can create a web ecosystem that respects users' autonomy Maybe 20 years ago I would've believed that coming from Google, but no, it's clear they're going full authoritarian to get users under their control like the rest of Big Tech and using the classic "security" argument to do it.
  - f33d5173 3y ago
    It is quizzical, isn't it? "Pervasive tracking of users goes against their autonomy". But what about when you do it? "We need to be able to keep the lights on, don't we? And anyways, users chose to visit our page, so they consented to any tracking" - how does any of that not apply to extensions the user installs?
    - Taywee 3y ago
      The cognitive dissonance of being a company that makes all its money spying on users, has a profit motivation to prevent others from spying on users, and needing to pretend to take the moral high ground for PR reasons at the same time.
lewantmontreal 3y ago
Wasn’t manifest v3 supposed to prevent dynamically loaded code? As the article says these extensions are featured but (I think) the latest update to v3 says: “In January 2023, use of Manifest V3 will become a prerequisite for the Featured badge in the Chrome Web Store.” https://chromeos.dev/en/posts/manifest-v-3-migration-timeline-update https://chromeos.dev/en/posts/manifest-v-3-migration-timelin...
- mnoorenberghe 3y ago
  Google announced on December 9 that this timeline was paused: https://groups.google.com/a/chromium.org/g/chromium-extensions/c/zQ77HkGmK9E https://groups.google.com/a/chromium.org/g/chromium-extensio...
- palant 3y ago
  Note: I am the author of this article. Migration to Manifest V3 has been postponed, all these extensions (like most extensions in Chrome Web Store) are using Manifest V2. Note that the changes in Manifest V3 are meant to prevent security vulnerabilities. Outright malicious extensions will always find a way.
  - palant 3y ago
    As I said, outright malicious extensions will always find a way. I now discovered a newer variant of these extensions, this time using Manifest V3. And they still run arbitrary code: https://palant.info/2023/06/02/how-malicious-extensions-hide-running-arbitrary-code/ https://palant.info/2023/06/02/how-malicious-extensions-hide...
- rektide 3y ago
  Yes, dynamic code is all outlawed. Disclaimer, I filed this issue. https://github.com/w3c/webextensions/issues/139 https://github.com/w3c/webextensions/issues/139
  - londons_explore 3y ago
    Thing is, you can't load javascript code... But you can easily write a mini virtual machine to run any code you download from the web. And due to javascripts introspection abilities, that VM can (if the developer wishes) do anything. The simplest javascript bytecode interpreter is probably only a few hundred bytes, which is easy to hide in a big extension.
tjpnz 3y ago
I get a cold sweat whenever I use Chrome Web Store. How do I know that what I'm downloading is legitimate and not malware that's been made to look like another well known extension? The download counts aren't useful in determining that either, it's just a number and who's to know that it hasn't been manipulated by bots? I'm wary of suggestions that Google could implement a meaningful review process. They claim to do that for ads, yet it's not unusual to see ads in search for software that's obviously malware.
- websap 3y ago
  This is why Apple has a developer fee and taxes a cut from app revenues to make it safer for users
  - lostmsu 3y ago
    https://www.wired.com/story/apple-app-store-malware-click-fraud/ https://www.wired.com/story/apple-app-store-malware-click-fr...
  - manuelabeledo 3y ago
    The Apple Store has malware in it too. User data is well worth $99 a year. That is not and never will be a deterrent.
    - throwaway290 3y ago
      But then supposedly they have your payment info on file if law goes after you
      - manuelabeledo 3y ago
        I would think that a criminal would not mind committing more crime to cover their tracks, e.g. use stolen credit card numbers.
        throwaway290 3y ago
munro 3y ago
<><>incoming rant<><> thank god i switched to firefox, not that i think their extension security is any better (naturally skeptic, as i assume everyone else is on here) i'm tired of google, the ad revenue model is a parasite on society. i just went to their office last week for some lame ass workshop. this company is rotting inside out. they do shitty software consulting now? obv yes their core technology is still incredibly valuable, but how have we not just rip that out of the company? (rhetorical) it's just an intuition, but i feel the end is neigh for google /rant/
- ant6n 3y ago
  I just wish google had a decent search engine.
  - famahar 3y ago
    It's shocking how bad it's become. Every google search feels like a bunch of random noise and clickbait. SEO and walled communities killed google search. Just wish there was a search engine that would effectively find info across all these walled sites. So much useful info hidden in discord, facebook communities, and slack chats.
    - ralusek 3y ago
      Google has gotten bad, but YouTube search is just...I don't even know how to describe it. They've decided that when you search for something, only the top 2 results should be related to your search, and after that it should just go back to listing things that are otherwise in your recommended feed (totally unrelated to your search query).
      - nsajko 3y ago
        The intitle keyword used to help, maybe it still does: https://news.ycombinator.com/item?id=31990043 https://news.ycombinator.com/item?id=31990043
- deleted 3y ago
  [deleted]
deleted 3y ago
[deleted]
zenapollo 3y ago
I don’t understand why there’s not an fdroid-like store for open source chrome extensions. All my most important extensions are open source. I try to find ones that are. But I’m not savvy enough to do checksums and all that so i just trust the deployed app is the same one on GitHub.
- palant 3y ago
  Note: I am the author of this article. It’s easy: Google owns the browser, so they decide which websites are allowed to install extensions. And Google decided a while ago that the only way to ensure your safety is allowing only Chrome Web Store as installation source. That’s it, installing extensions from third-party sources is so awkward that nobody will do it. Besides, automatic updates wouldn’t work anyway.
Joker_vD 3y ago
Every time I launch Chrome on one of my machines, it complains that an extension called "Privacy Test" has been disabled because of its dubiousness, reactivate/delete? I chose "Delete" every single time, and every single time, it comes back at the next Chrome restart. Apparently, it somehow managed to store itself into my Google account's sync data, because after several hours of googling apparently the only working way to get rid of it is to get a fresh Chrome install, not sync, then nuke all of the sync data. If only there was a way to see what's actually in the sync data and manage it on a more fine-grained level instead of having only a single "delete all" button or, you know, maybe Chrome could actually just bloody uninstall the extension I ordered it to uninstall? Maybe by the next century the technology will actually be there.
- lima 3y ago
  Check out chrome://sync-internals, it shows you every little detail.
- londons_explore 3y ago
  You have malware... It's software on your PC which is installing this extension again every time it sees it not present. Creating a new Chrome profile probably just tricks it because it is still installing it into the old profile. See here: https://support.google.com/chrome/thread/169489366/privacy-test-extension-randomly-installed-itself-how-do-i-remove-it-for-good https://support.google.com/chrome/thread/169489366/privacy-t...
  - Joker_vD 3y ago
    Nope, it's not, because it persists between clean Windows installs. In fact, using the chrome://sync-internals/ from the sibling comment, I can see a "Click&Clean App" in my Apps (not Extensions!), which has id "pdabfienifkbhoihedcgeogidfmibmhp" which id, if you open it in Google Store, leads to [0], which is a page for the Privacy Test extension. And I can't delete it from my profile, because Chrome let's you manage only Extensions, not Apps! [0] https://chrome.google.com/webstore/detail/privacy-test/pdabfienifkbhoihedcgeogidfmibmhp https://chrome.google.com/webstore/detail/privacy-test/pdabf...
cm2012 3y ago
Okay so funny story: I once worked with a company with insane security rules. 2FA every time you log into any program on your computer. I had to get fingerprinted to get a company laptop. No installation privileges. it goes on and on. And I was just a consultant with no access to code or anything, this is just to be able to attend meetings and see google docs. Chrome extensions? No limitations at all, not even checked, add whatever you want. I thought that was pretty funny.
ibejoeb 3y ago
I make a lot of extensions, and I still don't know how the screening happens in the various stores. It's not working well, whatever it is. Part of the solution ought to require a submission in source format for easier screening, either by people or AI. (It can be obfuscated in-store if that's really what the developer wants.)
- palant 3y ago
  Note: I am the author of this article. Mozilla and Opera require source code to be uploaded along with the extension, there is some human component involved in the review there. My understanding is that the human review got considerably less over time however. According to an email I received lately, Mozilla is reintroducing pre-publication review for popular extensions however. I always thought it to be odd that Google doesn’t ask for extension source code, even when an extension is flagged for review. No idea what kind of review they can perform this way.
  - liquidpele 3y ago
    What’s the point of asking for source if you do t use that to build it for the store yourself? People could just submit modified source right?
    - palant 3y ago
      Back when I reviewed add-ons for Mozilla Add-ons, I did in fact verify that the source code produced the same build result as the extension submitted. Was tricky occasionally but usually worked well.
- moneywoes 3y ago
  May I ask Any resources that have helped? What stack do you use
  - ibejoeb 3y ago
    I'm not aware of any good tools for web extension auditing.
almenon 3y ago
Chrome really needs to introduce a extension denylist. The effect of malicious extensions would be less if you could exclude banking and other sensitive websites. The current Allowlist is not sufficient because some extensions need to work across most sites.
Grom_PE 3y ago
I don't get how one is supposed to stay secure with the current way extensions work: all you have access to is a button that only installs and runs an extension, and at any point of time, it may automatically update with malicious code after the author has agreed to transfer control to someone else for an enticing sum of money. It happened several times before. To fix this, I've made my own UserJS that changes the "install" button into "download CRX", then I unpack the CRX file and remove the autoupdate URL from it so the code stays as it was when I last looked at it. Sometimes the extension's job is not worth having an extra extension installed (each spawns its own separate background process) so I paste the code into a userscript or a conglomerate extension instead. The chromium-based browser I use, Vivaldi, prevents injecting user scripts into "chrome.google.com" so I have to change the string in the browser binary to something like "chrame.google.com". Then it works.

216 points by campuscodi 3y ago

This will continue to get worse until Google takes security seriously on the Web Store. They don't meaningfully review uploads and they don't seem to staff it well in general - they take a very long time to process DMCA-related stuff, and when they do flag something for review (VERY rare) the review can take a very long time. Maybe it's unreasonable for me to expect them to invest money into running their "Store" but maintaining a reasonably popular extension for a while gave me a very low opinion of the whole service. I always have gotten the impression that the Chrome Web Store is something they'd rather get rid of if extensions (especially ad blockers) weren't a necessary evil to maintain their market dominance in browsers. The install and update UX have always been kind of neglected and awkward, and the permissions model is bad. Manifest V3 "fixes" some of this, I guess. As of today if I go to the chrome web store and try to install the recommended extensions on the front page, all of the ones I checked need to "read and change all my data on all websites" in order to do things like add a context menu option or run a connection speed test. There's no way for an ordinary user to tell the difference between "Chrome's permission model is garbage so every extension asks for this horrible permission" and "This extension is malicious and is actually going to read/change all my data"

Larrikin 3y ago
Have you tried Firefox?
- kevingadd 3y ago
  I've been using Firefox since 1.0, yes. I still end up needing a Blink-based browser installed to do my day job and access government websites, though, which means Edge or Chrome.
yjftsjthsd-h 3y ago
> They don't meaningfully review uploads and they don't seem to staff it well in general Well, yeah; it's Google. Their entire approach to anything resembling support is to automate everything that can be automated, and utterly ignore anything that can't be.
tyingq 3y ago
The current plan just seems to be to progressively reduce the functionality of extensions to the point that they don't do anything useful.
mbreese 3y ago
Are you surprised though? The Chrome Web Store isn't really a store... it's not like Chrome can (or does) charge for extensions. The only ones that are commercial that I'm aware of are tied to external systems (password managers, note taking, etc), and it's not like Google gets a cut from that. So the store will always be a cost center with net-negative revenue. Knowing this, how could they realistically review anything manually? The only model that has had some success in this regard has been the Apple App Store, which routinely gets vilified for it's walled garden. I'm not sure what the answer is here, but I'd pay extra for a more secure extension "store" for the (few) extensions that I use. Or pay more for the products I already pay for that provide extensions (1Password, Zotero, Pocket, etc...). But that would be a rounding error for Google's revenue, so I'm not holding my breath...

anilshanbhag 3y ago

I am the developer of Voice In (https://chrome.google.com/webstore/detail/voice-in-speech-to-text-d/pjnefijmagpdjfhhkpljicbbpicelgko?hl=en https://chrome.google.com/webstore/detail/voice-in-speech-to...), a Chrome extension with 300k+ users. Every month, I have 2-3 folks reach out asking for one of two things: 1) Something something Bing. Here is one from two days ago - https://imgur.com/a/KOwLRIC https://imgur.com/a/KOwLRIC 2) They want anonymized web browsing data. Google just yesterday sent out an email cracking down on this. From the email: To better protect users' browsing experience, the Quality Guideline changes clarify that an extension's purpose is to provide complimentary functionality for the browsing experience and should not seek to hijack a user's browsing or search experience. This update aims to ensure that users have full control over their browsing sessions, without any unwarranted interruptions or manipulations. By enforcing this policy, we strive to foster a safer and more enjoyable environment for all Chrome users, where their trust and satisfaction remain our top priorities. Together, we can create a web ecosystem that respects users' autonomy and offers seamless browsing experiences that truly enhance their lives.

userbinator 3y ago
Together, we can create a web ecosystem that respects users' autonomy Maybe 20 years ago I would've believed that coming from Google, but no, it's clear they're going full authoritarian to get users under their control like the rest of Big Tech and using the classic "security" argument to do it.
- f33d5173 3y ago
  It is quizzical, isn't it? "Pervasive tracking of users goes against their autonomy". But what about when you do it? "We need to be able to keep the lights on, don't we? And anyways, users chose to visit our page, so they consented to any tracking" - how does any of that not apply to extensions the user installs?
  - Taywee 3y ago
    The cognitive dissonance of being a company that makes all its money spying on users, has a profit motivation to prevent others from spying on users, and needing to pretend to take the moral high ground for PR reasons at the same time.

lewantmontreal 3y ago

Wasn’t manifest v3 supposed to prevent dynamically loaded code? As the article says these extensions are featured but (I think) the latest update to v3 says: “In January 2023, use of Manifest V3 will become a prerequisite for the Featured badge in the Chrome Web Store.” https://chromeos.dev/en/posts/manifest-v-3-migration-timeline-update https://chromeos.dev/en/posts/manifest-v-3-migration-timelin...

mnoorenberghe 3y ago
Google announced on December 9 that this timeline was paused: https://groups.google.com/a/chromium.org/g/chromium-extensions/c/zQ77HkGmK9E https://groups.google.com/a/chromium.org/g/chromium-extensio...
palant 3y ago
Note: I am the author of this article. Migration to Manifest V3 has been postponed, all these extensions (like most extensions in Chrome Web Store) are using Manifest V2. Note that the changes in Manifest V3 are meant to prevent security vulnerabilities. Outright malicious extensions will always find a way.
- palant 3y ago
  As I said, outright malicious extensions will always find a way. I now discovered a newer variant of these extensions, this time using Manifest V3. And they still run arbitrary code: https://palant.info/2023/06/02/how-malicious-extensions-hide-running-arbitrary-code/ https://palant.info/2023/06/02/how-malicious-extensions-hide...
rektide 3y ago
Yes, dynamic code is all outlawed. Disclaimer, I filed this issue. https://github.com/w3c/webextensions/issues/139 https://github.com/w3c/webextensions/issues/139
- londons_explore 3y ago
  Thing is, you can't load javascript code... But you can easily write a mini virtual machine to run any code you download from the web. And due to javascripts introspection abilities, that VM can (if the developer wishes) do anything. The simplest javascript bytecode interpreter is probably only a few hundred bytes, which is easy to hide in a big extension.

tjpnz 3y ago

I get a cold sweat whenever I use Chrome Web Store. How do I know that what I'm downloading is legitimate and not malware that's been made to look like another well known extension? The download counts aren't useful in determining that either, it's just a number and who's to know that it hasn't been manipulated by bots? I'm wary of suggestions that Google could implement a meaningful review process. They claim to do that for ads, yet it's not unusual to see ads in search for software that's obviously malware.

websap 3y ago
This is why Apple has a developer fee and taxes a cut from app revenues to make it safer for users
- lostmsu 3y ago
  https://www.wired.com/story/apple-app-store-malware-click-fraud/ https://www.wired.com/story/apple-app-store-malware-click-fr...
- manuelabeledo 3y ago
  The Apple Store has malware in it too. User data is well worth $99 a year. That is not and never will be a deterrent.
  - throwaway290 3y ago
    But then supposedly they have your payment info on file if law goes after you
    - manuelabeledo 3y ago
      I would think that a criminal would not mind committing more crime to cover their tracks, e.g. use stolen credit card numbers.
      - throwaway290 3y ago

munro 3y ago

<><>incoming rant<><> thank god i switched to firefox, not that i think their extension security is any better (naturally skeptic, as i assume everyone else is on here) i'm tired of google, the ad revenue model is a parasite on society. i just went to their office last week for some lame ass workshop. this company is rotting inside out. they do shitty software consulting now? obv yes their core technology is still incredibly valuable, but how have we not just rip that out of the company? (rhetorical) it's just an intuition, but i feel the end is neigh for google /rant/

ant6n 3y ago
I just wish google had a decent search engine.
- famahar 3y ago
  It's shocking how bad it's become. Every google search feels like a bunch of random noise and clickbait. SEO and walled communities killed google search. Just wish there was a search engine that would effectively find info across all these walled sites. So much useful info hidden in discord, facebook communities, and slack chats.
  - ralusek 3y ago
    Google has gotten bad, but YouTube search is just...I don't even know how to describe it. They've decided that when you search for something, only the top 2 results should be related to your search, and after that it should just go back to listing things that are otherwise in your recommended feed (totally unrelated to your search query).
    - nsajko 3y ago
      The intitle keyword used to help, maybe it still does: https://news.ycombinator.com/item?id=31990043 https://news.ycombinator.com/item?id=31990043
deleted 3y ago
[deleted]

deleted 3y ago

[deleted]

zenapollo 3y ago

I don’t understand why there’s not an fdroid-like store for open source chrome extensions. All my most important extensions are open source. I try to find ones that are. But I’m not savvy enough to do checksums and all that so i just trust the deployed app is the same one on GitHub.

palant 3y ago
Note: I am the author of this article. It’s easy: Google owns the browser, so they decide which websites are allowed to install extensions. And Google decided a while ago that the only way to ensure your safety is allowing only Chrome Web Store as installation source. That’s it, installing extensions from third-party sources is so awkward that nobody will do it. Besides, automatic updates wouldn’t work anyway.

Joker_vD 3y ago

Every time I launch Chrome on one of my machines, it complains that an extension called "Privacy Test" has been disabled because of its dubiousness, reactivate/delete? I chose "Delete" every single time, and every single time, it comes back at the next Chrome restart. Apparently, it somehow managed to store itself into my Google account's sync data, because after several hours of googling apparently the only working way to get rid of it is to get a fresh Chrome install, not sync, then nuke all of the sync data. If only there was a way to see what's actually in the sync data and manage it on a more fine-grained level instead of having only a single "delete all" button or, you know, maybe Chrome could actually just bloody uninstall the extension I ordered it to uninstall? Maybe by the next century the technology will actually be there.

lima 3y ago
Check out chrome://sync-internals, it shows you every little detail.
londons_explore 3y ago
You have malware... It's software on your PC which is installing this extension again every time it sees it not present. Creating a new Chrome profile probably just tricks it because it is still installing it into the old profile. See here: https://support.google.com/chrome/thread/169489366/privacy-test-extension-randomly-installed-itself-how-do-i-remove-it-for-good https://support.google.com/chrome/thread/169489366/privacy-t...
- Joker_vD 3y ago
  Nope, it's not, because it persists between clean Windows installs. In fact, using the chrome://sync-internals/ from the sibling comment, I can see a "Click&Clean App" in my Apps (not Extensions!), which has id "pdabfienifkbhoihedcgeogidfmibmhp" which id, if you open it in Google Store, leads to [0], which is a page for the Privacy Test extension. And I can't delete it from my profile, because Chrome let's you manage only Extensions, not Apps! [0] https://chrome.google.com/webstore/detail/privacy-test/pdabfienifkbhoihedcgeogidfmibmhp https://chrome.google.com/webstore/detail/privacy-test/pdabf...

cm2012 3y ago

Okay so funny story: I once worked with a company with insane security rules. 2FA every time you log into any program on your computer. I had to get fingerprinted to get a company laptop. No installation privileges. it goes on and on. And I was just a consultant with no access to code or anything, this is just to be able to attend meetings and see google docs. Chrome extensions? No limitations at all, not even checked, add whatever you want. I thought that was pretty funny.

ibejoeb 3y ago

I make a lot of extensions, and I still don't know how the screening happens in the various stores. It's not working well, whatever it is. Part of the solution ought to require a submission in source format for easier screening, either by people or AI. (It can be obfuscated in-store if that's really what the developer wants.)

palant 3y ago
Note: I am the author of this article. Mozilla and Opera require source code to be uploaded along with the extension, there is some human component involved in the review there. My understanding is that the human review got considerably less over time however. According to an email I received lately, Mozilla is reintroducing pre-publication review for popular extensions however. I always thought it to be odd that Google doesn’t ask for extension source code, even when an extension is flagged for review. No idea what kind of review they can perform this way.
- liquidpele 3y ago
  What’s the point of asking for source if you do t use that to build it for the store yourself? People could just submit modified source right?
  - palant 3y ago
    Back when I reviewed add-ons for Mozilla Add-ons, I did in fact verify that the source code produced the same build result as the extension submitted. Was tricky occasionally but usually worked well.
moneywoes 3y ago
May I ask Any resources that have helped? What stack do you use
- ibejoeb 3y ago
  I'm not aware of any good tools for web extension auditing.

almenon 3y ago

Chrome really needs to introduce a extension denylist. The effect of malicious extensions would be less if you could exclude banking and other sensitive websites. The current Allowlist is not sufficient because some extensions need to work across most sites.

Grom_PE 3y ago

I don't get how one is supposed to stay secure with the current way extensions work: all you have access to is a button that only installs and runs an extension, and at any point of time, it may automatically update with malicious code after the author has agreed to transfer control to someone else for an enticing sum of money. It happened several times before. To fix this, I've made my own UserJS that changes the "install" button into "download CRX", then I unpack the CRX file and remove the autoupdate URL from it so the code stays as it was when I last looked at it. Sometimes the extension's job is not worth having an extra extension installed (each spawns its own separate background process) so I paste the code into a userscript or a conglomerate extension instead. The chromium-based browser I use, Vivaldi, prevents injecting user scripts into "chrome.google.com" so I have to change the string in the browser binary to something like "chrame.google.com". Then it works.