Skip to main content
Information Security

Return to Question

Swap in tag for browser-extensions
Link
edit approved Nov 29, 2017 at 17:43
Michael come lately
edit approved Nov 29, 2017 at 17:43
Michael come lately
  • 3k
  • 2
  • 27
  • 43
replaced http://security.stackexchange.com/ with https://security.stackexchange.com/
Source Link
Community Bot
Community Bot
  • 1

Chrome extensions, and just like other browsers, appear to often get quite some extensive access to your browser data. In fact, most extensions I've installed require access to:

  • Your data on all websites
  • Your tabs and browsing activity

And this got me wondering what that implies, exactly.

Let's say somebody writes an evil extension, calls it "I-KNOW-EVERYTHING-YOU-DO, and a RSS Reader" (he's evil, but also honest). I really like to have a RSS reader, so I install this. I see this big warning about the extension requiring access to all of my data, but then again, so does every other extension, so I gladly grant this access.

Thinking worse-case scenario, what can this extension do? Could it:

  1. Send a list of all the websites I visit to the maker?
  2. Capture data I input into forms? (like my personal data, passwords, etc.)
  3. See how long I have been on a website, and which pages I have visited?
  4. Access cookies?
  5. Access other files on my computer? (I guess not, given the SandboxSandbox environment, but I'm still wondering)
  6. Do anything worse?

Chrome extensions, and just like other browsers, appear to often get quite some extensive access to your browser data. In fact, most extensions I've installed require access to:

  • Your data on all websites
  • Your tabs and browsing activity

And this got me wondering what that implies, exactly.

Let's say somebody writes an evil extension, calls it "I-KNOW-EVERYTHING-YOU-DO, and a RSS Reader" (he's evil, but also honest). I really like to have a RSS reader, so I install this. I see this big warning about the extension requiring access to all of my data, but then again, so does every other extension, so I gladly grant this access.

Thinking worse-case scenario, what can this extension do? Could it:

  1. Send a list of all the websites I visit to the maker?
  2. Capture data I input into forms? (like my personal data, passwords, etc.)
  3. See how long I have been on a website, and which pages I have visited?
  4. Access cookies?
  5. Access other files on my computer? (I guess not, given the Sandbox environment, but I'm still wondering)
  6. Do anything worse?

Chrome extensions, and just like other browsers, appear to often get quite some extensive access to your browser data. In fact, most extensions I've installed require access to:

  • Your data on all websites
  • Your tabs and browsing activity

And this got me wondering what that implies, exactly.

Let's say somebody writes an evil extension, calls it "I-KNOW-EVERYTHING-YOU-DO, and a RSS Reader" (he's evil, but also honest). I really like to have a RSS reader, so I install this. I see this big warning about the extension requiring access to all of my data, but then again, so does every other extension, so I gladly grant this access.

Thinking worse-case scenario, what can this extension do? Could it:

  1. Send a list of all the websites I visit to the maker?
  2. Capture data I input into forms? (like my personal data, passwords, etc.)
  3. See how long I have been on a website, and which pages I have visited?
  4. Access cookies?
  5. Access other files on my computer? (I guess not, given the Sandbox environment, but I'm still wondering)
  6. Do anything worse?
Tweeted twitter.com/#!/StackSecurity/status/205210275194994688
Source Link
please delete me
please delete me
  • 1.3k
  • 2
  • 10
  • 8

Worst case scenario, what can a Chrome extension do with "Your data on all websites" and "Your tabs and browsing activity"?

Chrome extensions, and just like other browsers, appear to often get quite some extensive access to your browser data. In fact, most extensions I've installed require access to:

  • Your data on all websites
  • Your tabs and browsing activity

And this got me wondering what that implies, exactly.

Let's say somebody writes an evil extension, calls it "I-KNOW-EVERYTHING-YOU-DO, and a RSS Reader" (he's evil, but also honest). I really like to have a RSS reader, so I install this. I see this big warning about the extension requiring access to all of my data, but then again, so does every other extension, so I gladly grant this access.

Thinking worse-case scenario, what can this extension do? Could it:

  1. Send a list of all the websites I visit to the maker?
  2. Capture data I input into forms? (like my personal data, passwords, etc.)
  3. See how long I have been on a website, and which pages I have visited?
  4. Access cookies?
  5. Access other files on my computer? (I guess not, given the Sandbox environment, but I'm still wondering)
  6. Do anything worse?