I've just discovered this:

  • You can create IFRAME pointing to "chrome-extension://" protocol
  • You can access IFRAME content with jQuery

Does this mean, I'm able to use badly written Chrome Extensions to exploit user workspace?


  • accessing extension files directly (sqlite db with passwords,...)
  • using chrome.extension.sendRequest call to interact with foreign extensions

to for example forcing stubleupon extension to like my page, without user confirming/creating the action?

Is this security issue or not?

  • 1
    I was looking into this not long ago, but I came to the conclusion that you couldn't access the IFRAME's contents. Do you mind sharing how this is done?
    – cobbal
    Oct 27, 2011 at 8:38
  • $('#iframeID').contents() api.jquery.com/contents Oct 27, 2011 at 8:40
  • When doing that I get the following error: Unsafe JavaScript attempt to access frame with URL chrome-extension://gkndfifopckmhdkohjeoljlbfnjhekfg/data/ui/popup.html from frame with URL http://example.com/drop/1684e00170648ceaf597b52380c2243a510b5b3a.html. Domains, protocols and ports must match.
    – cobbal
    Oct 27, 2011 at 8:45
  • Oh, my mistake. This method works outside of Google Chrome, so this is going to be closed as false ... Sorry Oct 27, 2011 at 9:07
  • 1
    @MarekSebera, I suggest that you post your conclusion as a short answer and accept it. I am pretty sure that there are other people out there, who make the same wrong assumption. So having an short explanation that there is no vulnerability because of the same origin check is helpful. Oct 27, 2011 at 14:54

2 Answers 2


Ok, so we came up with conclusion that this is not vulnerability
Although we have a way how to access IFRAME contents with $("selector").contents();
and although we can really point IFRAMEs to chrome-extension:// protocol

The point is, we cannot use this in Google Chrome only (till now)
Thanks to Google Chrome Javascript security implementation, we have to respect

Same Origin Policy (SOP)
described here: http://code.google.com/p/browsersec/wiki/Part2#Same-origin_policy_for_DOM_access

We cannot access DOM content loaded from other origin in the same session

Attack possibilities

It's still possible vulnerability, but with need of disabling SOP on google chrome
can be done like this:

chromium-browser --disable-web-security

but it is quite difficult to do it from within web browser ;-)

taken from here: https://stackoverflow.com/questions/3102819/chrome-disable-same-origin-policy


Krzysztof Kotowicz recently published a framework for exploiting vulnerabilities in Google Chrome extensions : XSS ChEF.

He described it in detail in his blog : http://blog.kotowicz.net/2012/07/xss-chef-chrome-extension-exploitation.html

  • 1
    Yes. However, it's worth mentioning that his framework is only applicable if the Chrome Extension contains a security vulnerability (e.g., a XSS vulnerability). Thus, as far as I can tell, his work seems to be unrelated to what this question is asking about. Or, maybe I misunderstood the question and this is relevant after all.
    – D.W.
    Nov 1, 2012 at 0:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .