Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
So, as far as I know, Chrome and possibly other browsers have a very low privilege process spawned for every tab.
How do browser extensions interact in regard to this sandboxing? I'm not talking about directly compromising an extension, but compromising Chrome, and then escaping from the tab sandbox by compromising the extension.
Access to privileged methods in a Chrome extension depends on two factors:
Chrome extensions can only request access to privileged APIs after declaring the necessary permissions in the manifest file. There is also a set of private APIs that are only available to an extension when their extension ID is whitelisted (hardcoded in Chromium's source code). This is not really relevant if you want to escape the sandbox, it just defines the boundaries of the impact of a compromise.
There are two "sandboxes". One that is visible to extension developers, that aims to protect users from websites that try to leverage the privileged extension methods. The other one is transparent to extension developers, and provides protection against compromised (render) processes.
Chrome is a multi-process application, consisting of one (high privilege) browser process, and multiple render processes. Each tab/site runs in its own process see Process Models for more details, with the minimal privileges necessary to execute their task.
Extensions can use so-called content scripts to modify the appearance or functionality of websites. These content scripts share the same process as the website on which they are acting, but the JavaScript code runs in a separate context. This allows the extension system to offer a very limited set of privileged JavaScript methods to the content script, e.g. in form of the extension message passing API and cross-origin AJAX. When a tab process is compromised, the damage is limited. It could make cross-domain requests (if the extension had the permission to do so) and send messages to the extension's background process, but not read files from your filesystem, nor use any of the more powerful extension APIs. When one tab process (renderer) is compromised, the damage is usually limited to that single tab/origin, thanks to the security architecture.
Other parts of the extension (e.g. background pages, popup pages and pages where the omnibox displays chrome-extension://[EXTENSIONID]/...) run in the extension process. Pages within the extension process can use powerful APIs provided that it has requested permissions to use them, including read access to files on your local file system (provided that it has requested access, and you have explicitly put a tick at the "Allow access to file URLs" checkbox at the extension settings page - this does not happen by accident, don't worry).
When an extension process is compromised, the damage is limited to what an extension can do. It cannot write to arbitrary files on you file system, for instance.
(note that a malicious extension developer does not need to go into the efforts of compromising an extension process, because if you install a malicious extension that requests the "Access your data on all websites" and "Access your tabs and browsing activity", then it already has sufficient power to mess with your websites, e.g. by stealing passwords when you type them).
I may not be properly answering your question, but I would say that they do not. Extensions are sandboxxed and follow a strict Content Security Policy.
From Sandboxing Eval:
...The solution on offer is a sandbox in which eval can execute code without access either to the extension's data or the extension's high-value APIs. No data, no APIs, no problem.
We accomplish this by listing specific HTML files inside the extension package as being sandboxed. Whenever a sandboxed page is loaded, it will be moved to a unique origin, and will be denied access to chrome.* APIs.
That same article has a very informative video linked here on YouTube about developing secure Chrome extensions that goes into deeper detail about extension security.
