I've just discovered this:
- You can create IFRAME pointing to "chrome-extension://" protocol
- You can access IFRAME content with jQuery
Does this mean, I'm able to use badly written Chrome Extensions to exploit user workspace?
by
- accessing extension files directly (sqlite db with passwords,...)
- using
chrome.extension.sendRequest
call to interact with foreign extensions
to for example forcing stubleupon extension to like my page, without user confirming/creating the action?
Is this security issue or not?
$('#iframeID').contents()
api.jquery.com/contentsUnsafe JavaScript attempt to access frame with URL chrome-extension://gkndfifopckmhdkohjeoljlbfnjhekfg/data/ui/popup.html from frame with URL http://example.com/drop/1684e00170648ceaf597b52380c2243a510b5b3a.html. Domains, protocols and ports must match.