Chrome users and malicious extensions

Question

I have 2 users in Chrome. One is used for personal purposes has gmail box, google disk, etc. The second one is "business" user who has another configuration, it's own gmail, google disk, etc.

Let's imagine that for business user I install some extension with read permission all data from all sites. One day this extension is bought by some bad person and it starts for send all my data I entered to all pages.

As far as I understand, correct me if I'm wrong, this extension can steal and send my passwords that I enter at any page for this business user. But if this one is installed can it still also a data from my personal user?

If there is a malicious extension for one user in Chrome, can it steal data for other users in the same chrome even if they did not install it?

Answer 1

"Steal" in the scope of what was allowed when you installed it? yes, this is due to Chrome's extensions auto-update feature and there are documented cases of this happening. You can however disable the automatic updater as described in this Stackoverflow answer, the main point is that the code from the extensions isn't compiled and you can edit it rather easily:

Step 1: Find the extension id

You can get this from the web store url, for example: https://chrome.google.com/webstore/detail/cfhdojbkjhnklbpkdaibdccddilifddb tells the id is cfhdojbkjhnklbpkdaibdccddilifddb

Step 2: Find the manifest file

On Windows: C:\Users\<User_Name>\AppData\Local\Google\Chrome\User Data\Default\Extensions

On Linux: ~/.config/google-chrome/Default/Extensions/

Step 3: Edit the manifest file

Browse to the folder where your extensions are, find the folder named according to the id from step 1, browse to the folder for the latest version (usually only one is there) and open the file manifest.json, edit the line for update_url so it looks like this:

"update_url": "https://localhost",

and it should lock that extension to that specific version you are running