2 Answers 2

7

Your assumption is incorrect, Firefox addons are not inherently more secure than Chrome extensions (though in terms of security, I attach more value to Firefox's official addon gallery (AMO) than the Chrome Web Store because all addons on AMO are manually reviewed).

Addons in Firefox are trusted by design; they can do anything that is allowed by the Firefox process. The worst-case scenario for installing a malicious Firefox addon is a re-install of your operating system to clean up the mess.

The Chrome extension APIs are very constrained, because the Chrome browser does not fully trust extensions (unlike Firefox). Chromium extensions can typically not access any resources outside Chrome's sandbox without the user's approval. The worst-case scenario in Chrome is less severe than Firefox' (and also applicable to Firefox): All of your web browsing activities can be considered compromised.

Since most of us increasingly spend more time in the web browser than in native applications (e.g. internet banking, e-mail), it is a stupid act to install extensions that you cannot trust. Considering this view, then Chrome extensions could be more secure because you have to consent to the every newly requested permissions upon installation/update. Firefox has not implemented any addon permission warnings, so when you install a Firefox addon, you should always mentally add a "This addon could access all data on your computer and the websites you visit" warning to the installation dialog.

On the other hand, because Firefox addons are more powerful, they can also integrate security features in a much better way than Chrome extensions. For example, to date it is not possible to create a NoScript equivalent in Chrome because of the limited extension API.

If you want to know more about Chrome's extension security design, I suggest to read:

8
  • 3
    +1 for mentioning NoScript as an example to highlight one of the differences of FF vs. Chrome :-) Aug 14, 2014 at 13:35
  • I wonder if that line about NoScript equivalents is still true. The Chrome web store seems to have several noscript alternatives listed chrome.google.com/webstore/search/NoScript
    – Ajedi32
    Mar 13, 2015 at 14:23
  • @Ajedi32 The part about NoScript is still true. The Chrome APIs are simply not powerful enough to offer all features from Firefox's NoScript.
    – Rob W
    Mar 13, 2015 at 14:27
  • At a glance it seems there are a number of APIs which could potentially be useful for implementing a NoScript plugin: developer.chrome.com/extensions/contentSettings developer.chrome.com/extensions/webRequest And the extensions shown in the link I posted in my previous comment seem to be able to prevent JavaScript execution. I haven't used NoScript before, so maybe I'm just confused: what features are those extensions lacking that NoScript has?
    – Ajedi32
    Mar 13, 2015 at 14:30
  • @Ajedi32 contentSettings.javascript applies to whole tabs only, it cannot be used to selectively disable JavaScript on domains in a (sub)frames.
    – Rob W
    Mar 13, 2015 at 16:05
1

Do they just appear to be more secure, or are they really?

While this is always changing with Firefox's continual drive to improve their security, many of their add-on's appear more secure than they are. Mainly due to what problems haven't been discovered yet. Note the popular NoScript issues outlined in the following security article here. And other problems with Firefox add-ons discussed here. This isn't an attack on Firefox. Next week chrome could be getting the same negative media attention.

Both teams develop their API (and API limitations) with end user security in mind. With new vulnerabilities being discovered frequently in cyber security research, at any given time one developers team may be ahead of the other.

I use both Chrome and Firefox and have a hard-time sticking with just one because as soon as I do, I find a vulnerability in one that is fixed in the other.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .