5 ms·
The bar for extensions is lower than breaking the browser security model. The goal is to slip basic XSS attacks past the Chrome Web Store review process, which
by a13o 3y ago
The bar for extensions is lower than breaking the browser security model. The goal is to slip basic XSS attacks past the Chrome Web Store review process, which is a mix of automated and human linters.
People over-pemission chrome extensions all the time, so you can execute arbitrary JS on any site you want once the user clicks ok. Why bother finding security sandbox exploits when users hand you the keys without thinking.
The extension platform is trying to further isolate extensions, but Google's profit motive is in its own way. See: MV3 and the response.
If Chrome offered an ad-blocker built in to the browser -- and maybe a privacy-blocker too -- they could eliminate the entire extension platform and solve the problem.
- hawk_ 3y agoEven firefox doesn't offer a built in ad-blocker.
- miohtama 3y agoOpera on mobile does offer some sort of an adblocker built in. However as it is a commercial company and free product, not sure what are the tradeoffs for using Opera.
- moritzwarhier 3y agoI would prefer the extension platform to allow users to explicitly control what origins an extension is allowed to be active on, overriding the extension manifest. This should be the default, and allowing an extension for all origins or wilcard origins should require a mandatory prompt indepenent of the installation process. Yes, extension privileges are creepy and an ad blocker (ublock origin only, to be exactly) is the only extension I intentionally allow to act on all websites on my behalf. Which is a conscious tradeoff. There are other useful extensions though, and I'd prefer a common permission architecture with frequent prompts to the current take-it-or-leave approach.
- patrakov 3y agoI would disagree that adding an ad-blocker and a privacy blocker would eliminate the entire extension platform. There is still legitimate space for text manipulation extensions such as LanguageTool, form autofill managers (e.g. for canned responses), debug tools (so that I can see e.g. the FPS counter of the rendering process), citation formatters, site-specific data export tools (I am looking at you, ChatGPT), and so on.