You cannot assume that an add-on is safe "because it's hosted in one of the official extension galleries".
In this answer, I start with the explanation of how extensions end up in the extension galleries for the popular browsers. Then, I dedicate an extra section to Chrome, and finalize with a case analysis for a specific Chrome extension.
How does an item get listed in the official stores?
- Anyone with Google Wallet can pay 5$ to upload up to 20 extensions/apps to the Chrome Web Store. Extensions with binary components (NPAPI) are always reviewed manually. Other extensions are only checked by Google's secret scanner, which may put an extension on hold ("Pending review") if needed. This scanner is not perfect: Two months ago, I found many malicious extensions that violate the Developer Program policies. (I've filed some Report abuse forms; some apps were taken down, others weren't even though they contained the same kind of adware).
- All Firefox add-ons on AMO are put in a review queue upon submission. All editors who review add-ons have to follow the guidelines as stated in Performing a review. Extension developers are supposed to follow these instructions.
- Safari extensions can be submitted to the Apple Extension gallery. Developers have to adhere to the requirements of this document pdf. After passing the review, the extension will be listed in the gallery. Apple does not host the extension files themselves. After passing review, the extension will receive a prominent location in the relatively quiet extension gallery. Upon click, the extension from an external location is immediately installed without confirmation.
- All extensions in Opera's extension gallery are manually reviewed. Extensions will only be listed if they pass review (acceptance criteria).
All of these four galleries support automatic updates of extensions. Unless stated otherwise, the updates will automatically be installed (unless turned off by the user).
Updates to Chrome extensions are automatically checked, sometimes followed by a manual review. When an extension requests more permissions, they're automatically disabled until a user confirms the new requirements. The developer documentation provides list of permission warnings and their meanings. Google has also created a page (with fewer details) to explain the warnings to users - see Permissions requested by apps and extensions.
Updates to Firefox add-ons are manually reviewed.
Updates to Opera extensions are manually reviewed. Opera abandoned their old extension ecosystem and switched to a Chromium-like extension API in Opera 15. Before Opera 15 (Opera 12.xx and earlier), updates were automatically installed. Starting from Opera 15, extensions are disabled when a new permission is added, just like Chromium (see this comment on Github).
Since Apple doesn't host the files themselves, updates to Safari extensions are not reviewed any more.
- Chrome extensions may contain external code.
- Safari extensions are hosted on servers not controlled by Apple, so the developer is free to include whatever they want.
Many extensions collect usage statistics without the user's consent. Chrome even offers a tutorial on setting up tracking in extensions...
Firefox and Opera are doing quite well with the security of their extension platform. I don't put as much trust in the Chrome web store, because it does not manually review all extensions.
The only way to be sure that an extension is safe is to review it yourself.
For this purpose, I've created the "Chrome extension source viewer" Chrome extension. This extension allows one to view the source code of an extension in the Chrome Web Store. It ships with a code beautifier to make it more readable.
The first place to look at it a file called
manifest.json, because it defines the capabilities of an extension. Do you see anything suspicious? For instance, does an extension which promises to add smileys to Facebook define a content script for
*://*/* (=match pattern for every page)? Don't install the extension.
Look at the list of files. Do you see a file called
analytics.js? Know that you're going be tracked. This is not necessarily wrong, but it's good to know. Look in the files for
_gaq.push, which is the standard way to use Google Analytics.
The user count and ratings can be deceptive. I'm going to analyse "Lyrics for Google Chrome™", a popular extension which has been around for a few years. Upon installation, the following prompt is shown:
Eek! But wait, it has 156k users and an average rating of 4.5, so it must be good, right?
Let's read the description:
* On Privacy *
Everytime an extension needs more acces (to certain websites), the extension is disabled by default. Since I'm trying to expand this extension to more music providers, I don't want the extension to be disabled over and over again. So I decided to grand it access to all URLs.
If you're worried about your privacy, remember that this is an open source project. Everyone can see: no sensitive data is collected.
That's promising. At the bottom of the description, there's even a link to the source code:
* Open source *
This extension is an open source project, which means that it can be translated and modified by other people too: https://github.com/haampie/Lyrics-for-Chrome
Must be good, right?
If you look through their source code on Github, you won't find anything harmful. But when you view the extension's source (e.g. using the view source extension I've mentioned before), you may scratch your head.
Some snippets from the background script:
// If input has been sent via the omnibox
// Send info to Google Analytics
_gaq.push(['_trackEvent', 'Usage', 'Omnibox']);
(when you use the search keyword, it's being submitted to Google Analytics)
// Send info to Google Analytics
_gaq.push(['_trackEvent', 'Usage', 'Page action', tab.url.split('/', 3).join('/')
(when you click on the badge button, the domain of the current page is submitted to Google analytics).
So, this extension has 156k users, 3.3k reviews (average 4.5), but it still deceives users! Be warned.