Skip to main content

Questions tagged [browser-extensions]

Browser extensions are additions to a web browser that provide extra functionality.

Filter by
Sorted by
Tagged with
19 votes
2 answers
4k views

Could a Google Chrome extension read my password?

I am concerned about the security of my passwords while using Google Chrome extensions. Specifically, I'd like to know if it's possible for a Chrome extension to read passwords that I enter on ...
goalTosin's user avatar
  • 301
1 vote
2 answers
373 views

How to determine which Chrome extension is re-directing me to ad sites

Twice now, seemingly randomly, I've been redirected to an ad site. I believe it has occurred both times when I have a new tab open, type what I'm searching for (Google is my default search engine), ...
johnfernow's user avatar
1 vote
1 answer
415 views

Are 2FA browser plugins sufficiently secure?

Regarding 2FA browser plugins, I follow the uneducated opinion that they usually provide sufficient security. Since a desktop computer is a unique device (even a virtual machine) and provides that ...
Jonathan Root's user avatar
0 votes
0 answers
90 views

What can be leaked using a browser extension where one of the extensions loads JavaScript from a remote site?

Can one remotely log my IP, browser history, and saved passwords? I think the IP should be easily done if one of the extensions load a remote JavaScript to run in my browser. I'm not sure about other ...
Maxfield's user avatar
  • 157
1 vote
1 answer
280 views

Can a browser-based HTTPS proxy secure browsing data while using a system-level proxy?

I use Nekoray to set up proxies for my Windows system. When I connect to those proxies, does using a browser-based proxy with HTTPS encryption secure my transferred data through the web browser? Can ...
Winner1's user avatar
  • 113
0 votes
0 answers
38 views

How to check if a Firefox add-on is malicious? [duplicate]

How to check if a Firefox add-on is malicious ? I'm interested about this one currently : https://addons.mozilla.org/en-US/firefox/addon/istilldontcareaboutcookies/ It got a Github repo
J. Doe's user avatar
  • 1
1 vote
0 answers
118 views

Why is not there encrypted way of sharing/showing data such as Password to the user (hidden from web app Source code)?

I wonder if there will be (or is) a way to hide data such as passwords from the HTML/DOM structure? As, password fields can hide from external person other than the main user with something like "...
BirukTes's user avatar
1 vote
1 answer
502 views

How do you hide your browser advertising fingerprint?

How do you hide your browser finger print from advertising networks without disabling javascript? Is there a browser extension that can help mask unique browser fingerprint? Browser finger print can ...
Christian's user avatar
  • 265
1 vote
0 answers
227 views

GPU vs integrated graphics hardware, browser canvas fingerprinting, and multi- or dual-boot systems

My goal is to ensure that two operating systems installed side-by-side on the same device are unable to return the same canvas fingerprint, when a modern browser is allowed to run javascript without ...
brynk's user avatar
  • 1,137
0 votes
1 answer
1k views

Can adblocker plus read your sensitive data or spy you? [duplicate]

Do adblockers read your sensitive data? https://adblockplus.org/ I'm referring to this, its open-source but I feel worried.
Mekatoo's user avatar
2 votes
2 answers
447 views

How to do auth without user interaction in an enterprise environment?

We are building a Chrome Extension that will be force-installed on each employee's browser for the companies we work with. We currently use OAuth but many employees are forgetting to sign up. We are ...
cypr's user avatar
  • 121
2 votes
1 answer
598 views

With HTTPS-only mode in Firefox, may I still need HTTPS Eveywhere addon?

Firefox has a built-in toggle in settings to enforce HTTPS-Only mode. When enabled, the browser attempts to redirect to HTTPS every time and, if fails, blocks access to the website in the same way ...
Roman Riabenko's user avatar
0 votes
1 answer
589 views

Why are there no modern web browsers that allow extension access to SSL information about the site you are browsing?

In all my Googling, I found one version of FireFox that allowed it temporarily a long time ago, it has been discussed on the Chromium development forums for years, but yet, as of today, there is still ...
8vtwo's user avatar
  • 420
1 vote
0 answers
843 views

Security of Third Party Plugins in Thunderbird

In Thunderbird (a popular open source email client), there is an extension store similar to Mozilla Firefox which adds further functionality to the client. Mozilla has an article detailing the ...
Harrison G's user avatar
1 vote
1 answer
374 views

Firefox add-ons: Which permission(s) govern the ability to make additional network requests?

I'm considering installing a Firefox add-on (browser extension) which requests the permission Access your data for all websites. This add-on is not on the list of Mozilla's "actively monitored&...
Jon Schneider's user avatar
0 votes
1 answer
123 views

Does moving webAuthn API from browser to OS improves security of registration process?

Usually, for all types of authentications, we trust the registration process and assume there is no attack is happening Like in the case of FIDO2 registration. However, as the registration process is ...
tarun14110's user avatar
0 votes
1 answer
313 views

Is there malicous HTML?

I'm writing a chrome extension that evaluates certain code blocks from GitHub pages, e.g., Lorem ipsum ```html-embed <iframe></iframe> ``` dolor site amet. and adds their content as HTML ...
Nico Schlömer's user avatar
0 votes
1 answer
188 views

Can I curb Honey's grab for my data by only using it within a separate profile?

I'm interested in getting a coupon code for an online purchase and to this end Honey is nice, but when it comes to protecting my data Honey is really invasive. Can I curb Honey's hunger for my whole ...
Alex Ixeras's user avatar
1 vote
1 answer
199 views

Chrome extensions: tool to notify users of ownership change (to avoid malicious code injection)? [closed]

A problem with Chrome extensions was raised in an earlier question: extension owners can sell their extension to another owner, who can then insert malicious code. From a user's perspective, they may ...
user108903's user avatar
0 votes
0 answers
24 views

Practical ways to tell if a Chrome extension is safe? [duplicate]

After reading about Emails a browser extension developer gets from scammers (and the comments here) I understand that there are people who try to convince good addon developers to introduce shady (or ...
stevec's user avatar
  • 1,310
0 votes
2 answers
229 views

Does an effective Content Security Policy mitigate a universal cross-site scripting vulnerability?

I am doing some background research into types of XSS and prevention and as I understand it there is not much any application can do against a universal XSS in a plugin or browser. A last line of ...
TJSullivan's user avatar
0 votes
0 answers
114 views

Web Browser Forgetting Between Users

I am planning to go door-to-door and host events in which people use a computer to login to the Arizona Secretary of State website, enter sensitive information (like address, social security number, ...
Eliter's user avatar
  • 51
5 votes
0 answers
673 views

Can Chrome extensions access other Chrome extensions' data?

Can the data in a password-manager Chrome extension be accessed by a different Chrome extension? For example, if one were to install a malicious extension, could that extension access the data (i.e., ...
Andrew's user avatar
  • 51
0 votes
0 answers
525 views

How to tell if my browsers are infected by ADROZEK?

MS has exposed ADROZEK: https://www.zdnet.com/article/microsoft-exposes-adrozek-malware-that-hijacks-chrome-edge-and-firefox/ I would like to know if the browsers (Chrome, blue ff) of my Ubuntu 20.04....
Juan Lanus's user avatar
2 votes
0 answers
267 views

What is the threat-model of a malicious browser-extension accessing the data of *another browser-extension* that is security-critical?

Modern password-managers are moving towards a "fully-in-the-browser" model (see: historical RCE on LastPass, and now 1Password is also moving towards 1Password X as "the future" ...
ELLIOTTCABLE's user avatar
0 votes
1 answer
244 views

Is JQuery in chrome extension a security concern?

This is the relevant part of my manifest.json file: "content_scripts": [ { "css": ["style.css"], "matches": [ "<all_urls>&...
shinzou's user avatar
  • 103
7 votes
2 answers
679 views

What impact does an installed extension have on the browser fingerprint (uniqueness)?

Motivation I want to develop a custom, local Firefox extension and investigate, if its installation has any impact on the browser fingerprint. Background Some time (years?) ago, there were articles ...
bela53's user avatar
  • 173
1 vote
1 answer
482 views

Chrome extension security

I want to install a Chrome extension called metamask. I do not trust this kind of software. (Maybe because I am a newbie) What can a Chrome extension do on my computer? Is it possible, for example, ...
Bob5421's user avatar
  • 51
1 vote
1 answer
1k views

Authentication in Next.js application (SSR SPA with long sessions)

We’re currently developing a Next.js application (server side rendering) and are looking for secure ways to keep the users logged in for longer periods of time. AFAIK this can either be done using ...
mrksbnch's user avatar
1 vote
1 answer
359 views

Securely storing a master key client-side

My company is currently evaluating a product which comes with a browser-extension-based password manager. The password manager is peripheral to their core product, but is the only way to use it. We're ...
Tom Locke's user avatar
7 votes
1 answer
2k views

Can Chrome Extensions Send Data to Remote Servers?

Suppose an extension has a scary list of permissions like that below ("Site access: On all sites"): Does this also give the extension permission to send my data to the author's servers via ...
Sam Manzer's user avatar
0 votes
0 answers
11 views

Chrome Malware, Redirects To Ad When I Click Link in Google? [duplicate]

I've been dealing with this Chrome malware for awhile now, and I can't identify where it's coming from. Very occasionally, when I click on a top link in Google, it'll redirect me to a site that looks ...
hhhhhhjyy78's user avatar
0 votes
1 answer
124 views

Credential theft by browser conferencing software?

While using the webex conference software, I noticed that simply pressing a "share content" button allows me to share my full screen. There was no security confirmation from my webbrowser (chrome): I ...
Listing's user avatar
  • 103
1 vote
1 answer
132 views

Would it be a big security vulnerability if someone wrote a browser extension to retrieve personal information on Google's behalf?

I am a 6th grader working in a project and came across the following question: On most browsers, you can inject JavaScript code into the browser, for example by typing in javascript:alert('Injecting ...
shreyasm-dev's user avatar
0 votes
0 answers
121 views

Domain Joined computer doesn't browser properly with any website with Let's Encrypt CA cert

Navigating to any website with Let's Encrypt CA cert and even after enabling the HTTPS Everywhere addon, I'm getting "Your connection is not private". Getting this error from all the browser except ...
Nɪsʜᴀɴᴛʜ ॐ's user avatar
32 votes
5 answers
7k views

How do I know if a Google Chrome extension is leaking data?

Many Google Chrome extensions require permissions to read the contents of webpages the user visits. How can the user verify whether and to what extent a certain Chrome extension leaks data?
gen's user avatar
  • 1,680
2 votes
1 answer
196 views

Is this sufficient to verify a website's domain?

I'm building a browser extension that will run some javascript, which contains some sensitive information (essentially injecting authentication info). Therefore I want to make sure it only executes it ...
personjerry's user avatar
  • 1,246
-1 votes
2 answers
1k views

Can I get a double layer protection if I use both desktop & browser based VPN?

Let's say, if I use both NordVPN's own software (random VPN location) and its Google Chrome VPN extension (random VPN location), does this add an extra layer of protection/encryption - means hiding ...
kadel2575's user avatar
38 votes
1 answer
7k views

Can a browser extension (Chrome, Firefox, etc.) read the web console log?

I realized that my bank handles sensitive information in the web console log, so my concern is if any browser extension could read the log?
Nyan D' Sparkle's user avatar
8 votes
3 answers
1k views

Browser setups to stay safe from malware and unwanted stuff

I have to set up a browser to surf the internet. I'm trying to stay safe from malware as much as possible. (I already know that there's no way to stay 100% safe.) My idea is to use Firefox with these ...
secon25's user avatar
  • 83
1 vote
1 answer
233 views

Is using an access token for authentication a bad idea

Is it right that if there is a malicious browser extension allowed to "Read and change all your data on the websites you visit." on the users's machine an access token can be potentially leaked no ...
Anton Litvinov's user avatar
-1 votes
1 answer
413 views

How common is the usage of browser zero-days in the wild?

We have an overview with known but fixed vulnerabilities for this browsers: Google Chrome, Mozilla Firefox and Internet Explorer. Such lists exist for many other browsers too. We also have such ...
Awaaaaarghhh's user avatar
0 votes
1 answer
864 views

Chrome extension screenshots- privacy risk?

Is it possible for Chrome extensions to monitor users without them knowing by taking screenshots and/or video? There's an extension called Screencastify that allows you to record your screen. This ...
user avatar
0 votes
1 answer
322 views

Blocking Standard Users (Win 10) from Adding Chrome Extensions

I want to block standard users (Win 10) from adding Chrome extensions. When the standard user renames the default folder, it overwrites any security policies applied on the Extensions folder.
Bilgraham Ng's user avatar
1 vote
1 answer
1k views

Installed sketchy Chrome extension - Potential malware infection?

So... Tired me was browsing through Ikea's website this morning and tried to use one of their visualisation tool. Got an error message saying that I was not running the lastest version of Adobe Flash. ...
Oberom's user avatar
  • 25
0 votes
1 answer
131 views

Firefox switches charset encoding, brings up request to install extensin. Is this a "browser virus"?

I use Devuan ASCII (~= Debian Stretch) on my desktop, with Firefox and Chromium as my browsers. As I came back to my computer today after a few hours of non-use, and loaded a new browser frame, ...
einpoklum's user avatar
  • 449
3 votes
2 answers
546 views

Are some privacy add-ons superfluous when using Tor browser?

If running the Tor browser, should you still have the same privacy add-ons as you would if you were running a "regular" browser? Or will some of them be superfluous because of the built-in ...
forthrin's user avatar
  • 1,811
3 votes
1 answer
2k views

Understanding which privacy tools provide very similar functionality

https://amiunique.org/tools has a list of recommended privacy tools. uBlock Ghostery HTTPS Everywhere Lightbeam AdBlock Plus Disconnect Privacy Badger NoScript Self-destructing cookies However, aren'...
forthrin's user avatar
  • 1,811
2 votes
0 answers
169 views

Collecting PII in an iframe on any website. Is it Safe?

I am building a chrome extension that allows users to submit a form on any website. Once a user would visit a certain website, extension would open iframe on that website and ask user for some PII in ...
Sargis Plus Plus's user avatar
0 votes
1 answer
9k views

Bitdefender showing lot of Getting Suspicious Connection Blocked from Chrome extension Toby

I'm using GetToby Chrome extension to manage my tabs and save them for later. Lately, I've been getting lots of notifications from BitDefender about blocked suspicious attempt: chrome.exe attempted ...
Bashar Abdullah's user avatar