Is it possible for a Firefox extension to read preferences or data stored by other Firefox extensions?

For example, could Firefox extension A, read any preferences or data stored by Firefox extension B?


Absolutely. Legacy Firefox extensions can do anything. They can access each others' preferences, snoop your Google password, read or write arbitrary files belonging to other extensions, read or write arbitrary files belonging to other software... anything.

Firefox is moving away from older overlay and bootstrapped extensions towards more isolated SDK and WebExtensions, but it's not there yet, and the older extension types are still fully supported.

You should absolutely only install trustworthy extensions, which is partly why Mozilla reviews extensions listed on AMO, and increasingly discourages unreviewed, unsigned extensions.

  • Thanks Matt. Can a Legacy extension be quickly identified by the fact that it is not restartless? Or can Legacy extensions be restartless as well? – RockPaperLizard Aug 11 '16 at 18:45
  • @RockPaperLizard I'm not certain of all the details, but it doesn't help. The oldest type of restartless extensions, so-called "bootstrapped" extensions, are capable of more or less as much as overlay extensions. – Matt Nordhoff Aug 11 '16 at 19:39
  • Thanks. How does one differentiate between Legacy extensions and isolated extensions? – RockPaperLizard Aug 11 '16 at 20:11

Is it possible? Hell yeah!

Going by the fact that there have been various malware in the past that could extract sensitive data from a browsers extensions.

Is it probable? Probably not.

If there was an issue, it'll be patched real fast. Browsers are a very important application in most peoples lives. Browser security is taken very seriously. This is why you need to keep updating your browser with the latest patches etc. Also, if you're that worried, you might want to use your browser in a different way - put it on a VM and don't do anything else on that VM except browsing the web. I wouldn't say that's 100% secure, as VM sandboxes have also been compromised in the past, but it's worth a shot if you really need the additional security.

  • I believe that Netscape allows cross-extension preference addressing as a feature, so updating won't fix this. I'm not sure I understand how a VM will protect one extension's preferences from another extension. Perhaps you could elaborate? – Neil Smithline Aug 11 '16 at 15:47
  • @NeilSmithline I agree with your second point. But Netscape? Did you just emerge from a time capsule that was sealed for nearly a decade? – RockPaperLizard Aug 11 '16 at 18:50
  • 1
    @RockPaperLizard, LOL! – theabhinavdas Aug 11 '16 at 18:51
  • @RockPaperLizard Guess I'm just loosing my memory in my old age – Neil Smithline Aug 11 '16 at 20:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.