4 ms·
I think this is a vulnerability. Sensitive browser extensions needs to consider malicious extensions in their threat model the same way that mobile apps need to
by j0hnyl 3y ago
I think this is a vulnerability. Sensitive browser extensions needs to consider malicious extensions in their threat model the same way that mobile apps need to consider malicious apps on the same device, etc.
- lxgr 3y agoI just re-read the article – there is no sensitive browser extension here, just a pure webapp. I wonder if the project will keep paying $1000 (begging the quesiton if that's denominated in USD or tokens "worth $1000"?) to everybody pointing out that pretty well-understood fact about the browser/extension security model to them?
- lxgr 3y agoDoes the browser extension model actually allow extensions to keep secrets from each other? I would hope so, but I'm not familiar with the APIs.
- j0hnyl 3y agoI'm not sure there's an out of the box mechanism for this, but imo if this is a risk to your extension, then you as the developer should have a mitigation for it.
- lxgr 3y agoI don't think the extension itself was even attacked here. It seems like the wallet credentials were stored in the localStorage of some website, which the (legitimate) extension can access, but a malicious one can as well. Update: It seems like there is no legitimate extension after all. The "attack" is just exfiltrating keys stored on some website's localStorage. That's arguably not even an attack, just the browser extension security model working as designed....