I realized that my bank handles sensitive information in the web console log, so my concern is if any browser extension could read the log?

  • 42
    If you have browser extensions that you don't trust, you have way bigger problems than whether they can read the log. Dec 31, 2019 at 20:32
  • 3
    What do you mean by "handles sensitive information"? Jan 1, 2020 at 20:30
  • 1
    Some information like login info, accounts number, etc. Jan 2, 2020 at 4:00
  • 6
    "my bank handles sensitive information in the web console log" -- Wow. Changing banks may be easier than getting them to change their code.
    – bishop
    Jan 2, 2020 at 18:11
  • 3
    You should probably be more worried about the code from several other websites that your bank loads to act as intermediaries between you and the bank's forms, as such code can alter and/or duplicate to a third party any information passing between you and your bank. And there's little you can do about it because banks are too stupid to realize that a secure communication should not be a "game of telephone". Jan 3, 2020 at 0:23

1 Answer 1


Any extension that has access to the DOM can read whatever is written to the console by intercepting calls. The console is a JavaScript object; it is simple to proxy calls to console.log, like this example from zzzzBov on Stack Overflow:

(function () {
  var log = console.log;
  console.log = function () {
    log.call(this, 'My Console!!!');
    log.apply(this, Array.prototype.slice.call(arguments));

However I should note that intercepting console.log is not necessarily what you should be worried about. If an attacker is able to run their own code within your browser, they can do a lot of bad stuff whether or not the bank uses console.log. For more on that, see this question: Worst case scenario what can a Chrome extension do with "Your data on all websites"

But that said, if they've left console.log statements in their production site, that's a code smell.

  • I would recommend a separate browser profile for banking to keep different trust domains separate.
    – Tanath
    Jan 9, 2020 at 11:05
  • This example doesn't work alone. Web extension hasn't the same "context" (window) as the page. You need to inject this code into the page and communicate back with the web extension using postMessage. More details here. Oct 9, 2020 at 18:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .