1

Detecting and outsmarting an AdBlocker is trivial, but this got me thinking about the issue in terms of a security battle between a page's native script and an extension. In terms of Chrome Extensions, is it possible to protect a user from himself? Lets say the user installs an ad blocker, and its actually stealing his credit card info. Does the web developer have the means to fight the actions of the extension via native page scripts?

Is this fundamentally possible? Why or why not?

Improve this question
1
  • 3
    User scripts are generally different than Chrome Extensions. User scripts have a different API than Chrome Extension API. But you seem to be using the words interchangeably. Do you mean one, the other, or both?
    – Neil Smithline
    Jul 1, 2016 at 20:32

1 Answer 1

Reset to default
2

No, because the user script/chrome extension could simply block the script element before it even loaded. A decently designed piece of malware would do this automatically.

Improve this answer
5
  • What if you load the script inline?
    – J.Todd
    Jul 1, 2016 at 20:56
  • You can still disable it. If I curl your webpage I can filter out the script tags, and still display it without scripting, styling, or any dynamic content.
    – Robert Mennell
    Jul 1, 2016 at 20:59
  • As Neil mentioned as a comment for the starting post, the API for userscripts and chrome extensions are different. Userscripts usually dont have the possibility to block requests so any kind of embedded JS will always run.
    – James Cameron
    Jul 1, 2016 at 21:28
  • @JamesCameron it can set the script's innerHtml attribute to ''
    – noɥʇʎԀʎzɐɹƆ
    Jul 2, 2016 at 1:06
  • After its been loaded into memory and executed, yes.
    – James Cameron
    Jul 2, 2016 at 10:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .