Firefox vs. Chrome extensions: Which are---ceteris paribus---more secure?

Question

As an 'extension' to earlier questions on this topic (for instance here and here),

• What makes Firefox extensions (appear) more secure than Chrome extensions?
• Do they just appear to be more secure, or are they really?

---

See also:

• Why do Chrome extensions need access to 'all my data' and 'browsing activity'?
• Worst case scenario, what can a Chrome extension do with "Your data on all websites" and "Your tabs and browsing activity"?
• Are official browser add-ons really safe?
• http://lifehacker.com/5990769/why-do-chrome-extensions-need-to-access-all-my-data
• https://support.google.com/chrome_webstore/answer/186213?hl=en-GB
• https://support.mozilla.org/en-US/kb/tips-assessing-safety-extension
• https://support.mozilla.org/en-US/kb/permission-request-messages-firefox-extensions

Answer 1

Your assumption is incorrect, Firefox addons are not inherently more secure than Chrome extensions (though in terms of security, I attach more value to Firefox's official addon gallery (AMO) than the Chrome Web Store because all addons on AMO are manually reviewed).

Addons in Firefox are trusted by design; they can do anything that is allowed by the Firefox process. The worst-case scenario for installing a malicious Firefox addon is a re-install of your operating system to clean up the mess.

The Chrome extension APIs are very constrained, because the Chrome browser does not fully trust extensions (unlike Firefox). Chromium extensions can typically not access any resources outside Chrome's sandbox without the user's approval. The worst-case scenario in Chrome is less severe than Firefox' (and also applicable to Firefox): All of your web browsing activities can be considered compromised.

Since most of us increasingly spend more time in the web browser than in native applications (e.g. internet banking, e-mail), it is a stupid act to install extensions that you cannot trust. Considering this view, then Chrome extensions could be more secure because you have to consent to the every newly requested permissions upon installation/update. Firefox has not implemented any addon permission warnings, so when you install a Firefox addon, you should always mentally add a "This addon could access all data on your computer and the websites you visit" warning to the installation dialog.

On the other hand, because Firefox addons are more powerful, they can also integrate security features in a much better way than Chrome extensions. For example, to date it is not possible to create a NoScript equivalent in Chrome because of the limited extension API.

If you want to know more about Chrome's extension security design, I suggest to read:

• Barth, Adam, et al. "Protecting Browsers from Extension Vulnerabilities." NDSS. 2010., available at http://www.adambarth.com/papers/2010/barth-felt-saxena-boodman.pdf
  The security foundations/design of the Chrome extension platform.

• Carlini, Nicholas, Adrienne Porter Felt, and David Wagner. "An Evaluation of the Google Chrome Extension Security Architecture." USENIX Security Symposium. 2012., available at https://www.usenix.org/system/files/conference/usenixsecurity12/sec12-final177_0.pdf
  An evaluation of the effectiveness of the Chrome extension security architecture.

• CRX API Security Checklist
  Security checklist for developers of Chrome extension APIs.

Answer 2

Do they just appear to be more secure, or are they really?

While this is always changing with Firefox's continual drive to improve their security, many of their add-on's appear more secure than they are. Mainly due to what problems haven't been discovered yet. Note the popular NoScript issues outlined in the following security article here. And other problems with Firefox add-ons discussed here. This isn't an attack on Firefox. Next week chrome could be getting the same negative media attention.

Both teams develop their API (and API limitations) with end user security in mind. With new vulnerabilities being discovered frequently in cyber security research, at any given time one developers team may be ahead of the other.

I use both Chrome and Firefox and have a hard-time sticking with just one because as soon as I do, I find a vulnerability in one that is fixed in the other.