0

I'm considering installing a Firefox add-on (browser extension) which requests the permission Access your data for all websites. This add-on is not on the list of Mozilla's "actively monitored" add-ons.

Since it's reasonable for this particular add-on to require that permission in order to do its job, I'm okay with this -- but only if the add-on does not also have the ability to exfiltrate / "phone home" data from sites I access, via network requests. (Either now, or in the future via an automatically-applied update to the add-on.)

Which of the 26 permissions (as of the time of this question) govern the ability of Firefox add-ons to make their own network requests? Or is the ability to make additional network requests silently available to all Firefox add-ons?

Related existing (but less specific) questions:

1 Answer 1

1

From the description of this specific permission:

Access your data for all websites
... Extensions requesting this permission might: ...
... Offer a password manager that reads and writes details of your username and password
Provide an ad blocker by reading the content of each web page you open to find and remove ad code

Thus, Access here means actually read-write access, i.e. it can make modifications to the page. If it can make modifications it can also inject content into the page, including script. Using this it can manipulate the page to let the page itself make HTTP requests to exfiltrate data, i.e. the requests don't even need to be directly done by the extension.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.