19

I am concerned about the security of my passwords while using Google Chrome extensions. Specifically, I'd like to know if it's possible for a Chrome extension to read passwords that I enter on websites. I wanted to download an extension, but it said that it can read data on the sites I open. I am not sure if it can do this when I am entering my password to login or signup for a site, so I want to know whether it can read my password.

1

2 Answers 2

44

Yes. Chrome extensions can add JavaScript to the page, and this way read and modify anything that is on any web page.

Chrome extensions from the Chrome Web Store are reviewed and scanned by Google for malicious code. This is not watertight, but provides some security. Extensions from other sources are less trustworthy.

There is an extension Chrome extension source viewer that makes it easy to view the source code of any Chrome extension in the web store. However, even if the code looks good today, an automatic update can later install malicious code anyway.

5
  • I am not sure if one can just read out a password in Javascript. Once I have seen something, value of a password-type INPUT box can be only written, but not read?
    – peterh
    Commented Jun 22 at 23:24
  • 3
    @peterh Nothing prevents it from being read. How else would you get green check marks “yes, you have successfully entered the exact same password in the Confirm Password field”? Commented Jun 22 at 23:48
  • @RomanOdaisky It can be replaced by various widgets behaving similarly like <input type="password", but not being one. But thanks, I will check it.
    – peterh
    Commented Jun 22 at 23:55
  • 1
    Since extensions control the DOM even if it was read only to javascript (it isn't), the field could just be changed to a different type where you can, or you could just intercept the form post event and read it there. The point is Chrome extensions have a LOT of control over the browser, and one should be wary. Commented Jun 23 at 18:50
  • Aren't extensions' access usually scoped to certain domains? I know there are some that mess with all sites, but the popup is pretty clear that it can "read and modify data on all sites" in that case Commented Jun 24 at 0:11
3

I tested this with a simple HTML file:

<html>
  <head>
    <script>
      const passField = document.getElementById("pass");
      
      passField.addEventListener("input", (event) => {
        console.log(event.target.value);
      });
    </script>
  </head>
  <body>
    <input id="pass" type="password" />
  </body>
</html>

In the latest version of Firefox (v127.0.1), typing anything into the password input displays the typed input.

Suffice to say, if an extension can run JavaScript on the webpage, then your typed passwords are not safe, and neither are your cookies.

1
  • Very good answer- but there are some settings that prohibit the ability of Java to run openly on webpages and I’m sure that, while this isn’t relevant to your answer, a lot of Chrome extensions are verified and checked for potentially malicious code such as yours- but still- good demonstration of how it could easily be done if the situation arose. +1 for the effort of writing an example. Commented Jun 23 at 22:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .