Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I usually play Mafia Wars and use bookmarklets like Spockholm, Arum, etc. Can these bookmarklets get my Facebook data when I run them, they usually ask to unframe the Facebook page?

I was just wondering if it was possible that they're stealing my friends' info from Facebook and selling it on to advertisers?

share|improve this question

migrated from Dec 9 '11 at 10:59

This question came from our site for passionate videogamers on all platforms.

up vote 7 down vote accepted

A bookmarklet is basically a snippet of Javascript that runs on the website. As such, it has access to all your data on the site. Most bookmarklets don't do anything with your data, but it is certainly possible and you should always be careful.

share|improve this answer
You can examine the source code of the bookmarklet, if you speak Javascript, to be sure. – Mad Scientist Nov 8 '10 at 10:05
And/or post it on an SE site to ask what the code does. – Wikwocket Dec 2 '10 at 23:14

This is very dangerous. Another term for this attack is Self-Inflicted XSS. This article describes a type of malware that convinces its users into executing its javascript payload and then uses Facebook chat to convince your friends to execute the same code. Thus spreading much like a worm.

share|improve this answer

You should always be careful, also, with which resources a bookmarklet accesses. For instance, one thing that's both useful and dangerous is to create a new script tag and add it to the body of the page. That allows the script to run in that page, and AFAIK it's access restrictions are the same of any other script loaded "the regular way". I've seen bookmarlets like this for Firebug Lite and Delicious, but there might be many more.

The usefullness is obvious: you can do a lot more, and much more complex tasks, using that page data. But the risk is not always obvious, since even if you reviewed the script yourself and found no problem with it, if you don't control the site where the script is coming from you can never be sure that it won't be replaced with a less secure or even malicius one.

On the other hand, I assume the script (being from a different origin) would not be able to make HTTP requests on your behalf, so its damage would be limited to data already present in your browser. But I'm not sure about this, maybe someone more knowledgable in browser access permissions can answer that.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.