When you visit a page, could that page tell what extensions you are running if javascript is enabled? If so then could we stop them or at least make it extremely difficult to increase our privacy?
If the site can control the extension, yes. Look at chrome.runtime.onMessageExternal.addListener
.
If the site can't control the extension, no. Chrome protects the extensions.
But there are ways.
If the extension has
web_accessible_resources
, the javascript of the website can XHR or whatever to the resource (e.g.chrome-extension://oiplkfaidhjklglajdpfehoagkmlcakh/images/camera.png
for Pig Toolbox) and check the reply.If the extension modifies DOM, the site can detect it using Javascript.
If it is not an extension but an app, the site can just use chrome.app.isInstalled
If the extension wants to check other extension, it can use chrome.runtime.onMessageExternal
-
1I imagine there are a number of fingerprinting methods they can use as well. – forest Dec 27 '18 at 7:02
<noscript></noscript>
tag (if there is any) or will just not request your JS file. If JS is allowed on that domain, then you could trigger XSS-like request and check if it gets blocked. But here you have to be careful, because you have to distinguish anti-XSS mechanisms between no-XSS-extensions and browsers, e.g. google chrome's XSS auditor VS NoScript's XSS filter. I think you take like top 50 extensions and just check make very specific check for each of them. – Awaaaaarghhh Aug 24 at 19:03