3 ms·
it's a reasonably difficult problem as you want turing complete computation, but then if you have that you can make state escape the sandbox by blocking/not blo
by blibble 2y ago
it's a reasonably difficult problem as you want turing complete computation, but then if you have that you can make state escape the sandbox by blocking/not blocking certain requests and transmit a single bit at a time
you'd think with their legions of competent engineers they'd be able to come up with some way of defeating this attack
but that would hurt the business over the blunt MV3 approach, and you're not going to get promoted for that...
- amluto 2y ago> transmit a single bit at a time This is a really awkward attack for a couple reasons. In general, a malicious extension may have no way to tell whether a request was blocked — the origin if the request doesn’t belong to the extension authors, and the portion of the extension outside the sandbox won’t be told which requests were allowed. And, if too many requests are blocked apparently at random, the user may well notice. It’s surely possible to sneak out some data, slowly, over a noisy channel, but it doesn’t sound straightforward. Compare to actual manifest V3, where exfiltrating the keys to the kingdom appears to be entire trivial as long as the extension doesn’t try to block ads.