49

Chrome extensions, and just like other browsers, appear to often get quite some extensive access to your browser data. In fact, most extensions I've installed require access to:

  • Your data on all websites
  • Your tabs and browsing activity

And this got me wondering what that implies, exactly.

Let's say somebody writes an evil extension, calls it "I-KNOW-EVERYTHING-YOU-DO, and a RSS Reader" (he's evil, but also honest). I really like to have a RSS reader, so I install this. I see this big warning about the extension requiring access to all of my data, but then again, so does every other extension, so I gladly grant this access.

Thinking worse-case scenario, what can this extension do? Could it:

  1. Send a list of all the websites I visit to the maker?
  2. Capture data I input into forms? (like my personal data, passwords, etc.)
  3. See how long I have been on a website, and which pages I have visited?
  4. Access cookies?
  5. Access other files on my computer? (I guess not, given the Sandbox environment, but I'm still wondering)
  6. Do anything worse?
  • 11
    I'd guess he can replace the next .exe you download by a malware exe and then owns your computer. – CodesInChaos Mar 18 '13 at 10:23
  • Personal information I think (phishing)... – EKons Aug 16 '16 at 14:02
25
  1. Yes
  2. Yes
  3. Yes
  4. Updated, See the comment from George Bailey for this one.
  5. No - like you say the sandbox will prevent that.
  6. Read (and send) data on all the pages you visit.

Some more details on why this is often needed, but not always is discussed in this question Why do Chrome extensions need access to 'all my data' and 'browsing activity'?

  • 12
    Great answer, except for number 4. Cookies without the httponly flag can be accessed for sure, beyond that I don't know. I would add that it is likely that the extension could manually call, for example your Gmail page and get all your emails, even if you do not have Gmail open during the time the extension is opened. You need only to be logged in and it can call those pages. So even if the httponly cookies can not be directly viewed (number 4), it doesn't really matter, because the cookies can still be indirectly and effectively used. – Bryan Field May 22 '12 at 20:03
  • 1
    @GeorgeBailey - I'm not sure how well they can effectively use an http only cookie with modern content security policy (preventing inline scripting; loading external non-https scripts) / same-origin policy. Its little difference as they can still just capture your actual username / password from whenever you actually log in somewhere. – dr jimbob May 22 '12 at 21:42
  • 3
    Whoa whoa whoa... this is really a bad situation! Incredible that browser extensions are set up this way. We should really be strongly complaining about this, and for now, I will remove all extensions I have. Thanks for the answer! – please delete me May 24 '12 at 12:22
  • 1
    Thanks; I did read the link and I understand the why. However, I just feel this is something a) people should be more aware of, and b) we should not accept! This is a situation far from ideal and it should change! Well, let me start by trying to convince others that something should be done. For now, I'll remove all plugins... – please delete me May 26 '12 at 0:01
  • 2
    So does this mean an extension with Your data on all websites permission can access my banking password I enter on my bank's website? – User Apr 18 '15 at 1:07
7

Google briefly explains the security model for extensions in the following blog post:

http://blog.chromium.org/2009/12/security-in-depth-extension-system.html

Only install extensions by trusted sources.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.