3

When you visit a page, could that page tell what extensions you are running if javascript is enabled? If so then could we stop them or at least make it extremely difficult to increase our privacy?

| improve this question | |
  • 1
    Most of the assets related with a Chrome extension are treated as having a unique origin. JavaScript on the page can’t retrieve them due to Same-Origin Policy. However - many extensions modify the DOM, and iirc there’s nothing preventing the site from identifying and fingerprinting those manipulations. – user18519 Sep 14 '18 at 11:23
  • What are DOM and IIRC? – Faded Phoenix Sep 24 '18 at 17:53
  • Document object model (DOM) and if I recall correctly (iirc), respectively. – user18519 Sep 24 '18 at 17:55
  • E.g. there are several ways how you could detect NoScript. If JS is completely deactivated, then user will enter <noscript></noscript> tag (if there is any) or will just not request your JS file. If JS is allowed on that domain, then you could trigger XSS-like request and check if it gets blocked. But here you have to be careful, because you have to distinguish anti-XSS mechanisms between no-XSS-extensions and browsers, e.g. google chrome's XSS auditor VS NoScript's XSS filter. I think you take like top 50 extensions and just check make very specific check for each of them. – Awaaaaarghhh Aug 24 '19 at 19:03
  • I mean I searched already how to detect it. At least it is not so easy on modern desktop browsers. I don't know about mobile browsers. Desktop browsers are obviously protecting their extensions. That would be a security hole if one would allow to show browsers extensions to everyone. I mean there is a difference e.g. if you are using anti-WebRtc extension or not, if you're using uMatrix or you have no XSS&Co protection at all. Because I would consider it as client-side information leak. – Awaaaaarghhh Aug 24 '19 at 19:08
1

If the site can control the extension, yes. Look at chrome.runtime.onMessageExternal.addListener.

If the site can't control the extension, no. Chrome protects the extensions.

But there are ways.

  1. If the extension has web_accessible_resources, the javascript of the website can XHR or whatever to the resource (e.g. chrome-extension://oiplkfaidhjklglajdpfehoagkmlcakh/images/camera.png for Pig Toolbox) and check the reply.

  2. If the extension modifies DOM, the site can detect it using Javascript.

If it is not an extension but an app, the site can just use chrome.app.isInstalled

If the extension wants to check other extension, it can use chrome.runtime.onMessageExternal

| improve this answer | |
  • 1
    I imagine there are a number of fingerprinting methods they can use as well. – forest Dec 27 '18 at 7:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.