Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Chrome extensions, and just like other browsers, appear to often get quite some extensive access to your browser data. In fact, most extensions I've installed require access to:

  • Your data on all websites
  • Your tabs and browsing activity

And this got me wondering what that implies, exactly.

Let's say somebody writes an evil extension, calls it "I-KNOW-EVERYTHING-YOU-DO, and a RSS Reader" (he's evil, but also honest). I really like to have a RSS reader, so I install this. I see this big warning about the extension requiring access to all of my data, but then again, so does every other extension, so I gladly grant this access.

Thinking worse-case scenario, what can this extension do? Could it:

  1. Send a list of all the websites I visit to the maker?
  2. Capture data I input into forms? (like my personal data, passwords, etc.)
  3. See how long I have been on a website, and which pages I have visited?
  4. Access cookies?
  5. Access other files on my computer? (I guess not, given the Sandbox environment, but I'm still wondering)
  6. Do anything worse?
share|improve this question
    
I'd guess he can replace the next .exe you download by a malware exe and then owns your computer. –  CodesInChaos Mar 18 '13 at 10:23
add comment

2 Answers

up vote 5 down vote accepted
  1. Yes
  2. Yes
  3. Yes
  4. Updated, See the comment from George Bailey for this one.
  5. No - like you say the sandbox will prevent that.
  6. Read (and send) data on all the pages you visit.

Some more details on why this is often needed, but not always is discussed in this question Why need Chrome plugins access to 'all my data' and 'browsing activity'?

share|improve this answer
3  
Great answer, except for number 4. Cookies without the httponly flag can be accessed for sure, beyond that I don't know. I would add that it is likely that the extension could manually call, for example your Gmail page and get all your emails, even if you do not have Gmail open during the time the extension is opened. You need only to be logged in and it can call those pages. So even if the httponly cookies can not be directly viewed (number 4), it doesn't really matter, because the cookies can still be indirectly and effectively used. –  George Bailey May 22 '12 at 20:03
    
@GeorgeBailey - I'm not sure how well they can effectively use an http only cookie with modern content security policy (preventing inline scripting; loading external non-https scripts) / same-origin policy. Its little difference as they can still just capture your actual username / password from whenever you actually log in somewhere. –  dr jimbob May 22 '12 at 21:42
    
Whoa whoa whoa... this is really a bad situation! Incredible that browser extensions are set up this way. We should really be strongly complaining about this, and for now, I will remove all extensions I have. Thanks for the answer! –  user May 24 '12 at 12:22
    
You should read the link I gave in order to understand why it is like that! There is often a need for plugins to read the data, but not always - and there is a risk with installing untrusted plugins. –  Jontas May 24 '12 at 18:09
    
Thanks; I did read the link and I understand the why. However, I just feel this is something a) people should be more aware of, and b) we should not accept! This is a situation far from ideal and it should change! Well, let me start by trying to convince others that something should be done. For now, I'll remove all plugins... –  user May 26 '12 at 0:01
add comment

Google briefly explains the security model for extensions in the following blog post:

http://blog.chromium.org/2009/12/security-in-depth-extension-system.html

Only install extensions by trusted sources.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.