Detecting and outsmarting an AdBlocker is trivial, but this got me thinking about the issue in terms of a security battle between a page's native script and an extension. In terms of Chrome Extensions, is it possible to protect a user from himself? Lets say the user installs an ad blocker, and its actually stealing his credit card info. Does the web developer have the means to fight the actions of the extension via native page scripts?

Is this fundamentally possible? Why or why not?

  • 3
    User scripts are generally different than Chrome Extensions. User scripts have a different API than Chrome Extension API. But you seem to be using the words interchangeably. Do you mean one, the other, or both? – Neil Smithline Jul 1 '16 at 20:32

No, because the user script/chrome extension could simply block the script element before it even loaded. A decently designed piece of malware would do this automatically.

| improve this answer | |
  • What if you load the script inline? – Viziionary Jul 1 '16 at 20:56
  • You can still disable it. If I curl your webpage I can filter out the script tags, and still display it without scripting, styling, or any dynamic content. – Robert Mennell Jul 1 '16 at 20:59
  • As Neil mentioned as a comment for the starting post, the API for userscripts and chrome extensions are different. Userscripts usually dont have the possibility to block requests so any kind of embedded JS will always run. – James Cameron Jul 1 '16 at 21:28
  • @JamesCameron it can set the script's innerHtml attribute to '' – noɥʇʎԀʎzɐɹƆ Jul 2 '16 at 1:06
  • After its been loaded into memory and executed, yes. – James Cameron Jul 2 '16 at 10:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.