Questions tagged [browser-extensions]

Browser extensions are additions to a web browser that provide extra functionality.

Filter by
Sorted by
Tagged with
0
votes
1answer
32 views

Is JQuery in chrome extension a security concern?

This is the relevant part of my manifest.json file: "content_scripts": [ { "css": ["style.css"], "matches": [ "<all_urls>&...
0
votes
0answers
28 views

Browser with flexibility for tool integration

Browsers don't allow a JavaScript to spoof/modify 'Host' header. It's a part of a browser's security. For a regular user that is a feature, for me that is a limitation in a context of my tool which ...
6
votes
2answers
132 views

What impact does an installed extension have on the browser fingerprint (uniqueness)?

Motivation I want to develop a custom, local Firefox extension and investigate, if its installation has any impact on the browser fingerprint. Background Some time (years?) ago, there were articles ...
1
vote
1answer
70 views

Chrome extension security

I want to install a Chrome extension called metamask. I do not trust this kind of software. (Maybe because I am a newbie) What can a Chrome extension do on my computer? Is it possible, for example, ...
1
vote
1answer
129 views

Authentication in Next.js application (SSR SPA with long sessions)

We’re currently developing a Next.js application (server side rendering) and are looking for secure ways to keep the users logged in for longer periods of time. AFAIK this can either be done using ...
1
vote
1answer
65 views

Securely storing a master key client-side

My company is currently evaluating a product which comes with a browser-extension-based password manager. The password manager is peripheral to their core product, but is the only way to use it. We're ...
5
votes
1answer
160 views

Can Chrome Extensions Send Data to Remote Servers?

Suppose an extension has a scary list of permissions like that below ("Site access: On all sites"): Does this also give the extension permission to send my data to the author's servers via ...
0
votes
0answers
11 views

Chrome Malware, Redirects To Ad When I Click Link in Google? [duplicate]

I've been dealing with this Chrome malware for awhile now, and I can't identify where it's coming from. Very occasionally, when I click on a top link in Google, it'll redirect me to a site that looks ...
0
votes
1answer
48 views

Credential theft by browser conferencing software?

While using the webex conference software, I noticed that simply pressing a "share content" button allows me to share my full screen. There was no security confirmation from my webbrowser (chrome): I ...
0
votes
0answers
197 views

Chrome extension differences: Urban Shield VS Urban Free VPN proxy Unblocker

What's the difference between these two Chrome extensions, which provide VPN functionality for browsing via Chrome: Urban Shield: https://chrome.google.com/webstore/detail/urban-shield/...
1
vote
1answer
60 views

Would it be a big security vulnerability if someone wrote a browser extension to retrieve personal information on Google's behalf?

I am a 6th grader working in a project and came across the following question: On most browsers, you can inject JavaScript code into the browser, for example by typing in javascript:alert('Injecting ...
0
votes
0answers
36 views

Domain Joined computer doesn't browser properly with any website with Let's Encrypt CA cert

Navigating to any website with Let's Encrypt CA cert and even after enabling the HTTPS Everywhere addon, I'm getting "Your connection is not private". Getting this error from all the browser except ...
32
votes
5answers
6k views

How do I know if a Google Chrome extension is leaking data?

Many Google Chrome extensions require permissions to read the contents of webpages the user visits. How can the user verify whether and to what extent a certain Chrome extension leaks data?
2
votes
1answer
116 views

Is this sufficient to verify a website's domain?

I'm building a browser extension that will run some javascript, which contains some sensitive information (essentially injecting authentication info). Therefore I want to make sure it only executes it ...
-1
votes
2answers
173 views

Can I get a double layer protection if I use both desktop & browser based VPN?

Let's say, if I use both NordVPN's own software (random VPN location) and its Google Chrome VPN extension (random VPN location), does this add an extra layer of protection/encryption - means hiding ...
39
votes
1answer
5k views

Can a browser extension (Chrome, Firefox, etc.) read the web console log?

I realized that my bank handles sensitive information in the web console log, so my concern is if any browser extension could read the log?
7
votes
3answers
556 views

Browser setups to stay safe from malware and unwanted stuff

I have to set up a browser to surf the internet. I'm trying to stay safe from malware as much as possible. (I already know that there's no way to stay 100% safe.) My idea is to use Firefox with these ...
1
vote
1answer
60 views

Is using an access token for authentication a bad idea

Is it right that if there is a malicious browser extension allowed to "Read and change all your data on the websites you visit." on the users's machine an access token can be potentially leaked no ...
-2
votes
1answer
186 views

How common is the usage of browser zero-days in the wild?

We have an overview with known but fixed vulnerabilities for this browsers: Google Chrome, Mozilla Firefox and Internet Explorer. Such lists exist for many other browsers too. We also have such ...
0
votes
0answers
423 views

Chrome extension screenshots- privacy risk?

Is it possible for Chrome extensions to monitor users without them knowing by taking screenshots and/or video? There's an extension called Screencastify that allows you to record your screen. This ...
0
votes
1answer
161 views

Blocking Standard Users (Win 10) from Adding Chrome Extensions

I want to block standard users (Win 10) from adding Chrome extensions. When the standard user renames the default folder, it overwrites any security policies applied on the Extensions folder.
0
votes
1answer
834 views

Installed sketchy Chrome extension - Potential malware infection?

So... Tired me was browsing through Ikea's website this morning and tried to use one of their visualisation tool. Got an error message saying that I was not running the lastest version of Adobe Flash. ...
0
votes
1answer
48 views

Firefox switches charset encoding, brings up request to install extensin. Is this a “browser virus”?

I use Devuan ASCII (~= Debian Stretch) on my desktop, with Firefox and Chromium as my browsers. As I came back to my computer today after a few hours of non-use, and loaded a new browser frame, ...
3
votes
2answers
258 views

Are some privacy add-ons superfluous when using Tor browser?

If running the Tor browser, should you still have the same privacy add-ons as you would if you were running a "regular" browser? Or will some of them be superfluous because of the built-in ...
3
votes
1answer
677 views

Understanding which privacy tools provide very similar functionality

https://amiunique.org/tools has a list of recommended privacy tools. uBlock Ghostery HTTPS Everywhere Lightbeam AdBlock Plus Disconnect Privacy Badger NoScript Self-destructing cookies However, aren'...
2
votes
0answers
53 views

Collecting PII in an iframe on any website. Is it Safe?

I am building a chrome extension that allows users to submit a form on any website. Once a user would visit a certain website, extension would open iframe on that website and ask user for some PII in ...
0
votes
1answer
5k views

Bitdefender showing lot of Getting Suspicious Connection Blocked from Chrome extension Toby

I'm using GetToby Chrome extension to manage my tabs and save them for later. Lately, I've been getting lots of notifications from BitDefender about blocked suspicious attempt: chrome.exe attempted ...
14
votes
2answers
6k views

Is Stylish safe to use again?

Stylish is/was a very popular extension for the Chrome and Firefox web browsers, which let users add custom styles to certain websites. I was using it myself, until a helpful fellow told me it was ...
0
votes
1answer
95 views

Why are there no browser feature or extension to only check the domain and username to prevent phishing?

One of the recommendations to prevent phishing using look-alike domain names (like www.google.com.phishing.org or IDN homograph attacks) is to use a password manager or a physical security token like ...
2
votes
1answer
110 views

I found a browser extension I don't trust installed, should I worry?

Someone told me that their Firefox had a strange new menu bar. I found that it was “FindYourMaps”. FindYourMaps is a deceptive browser toolbar that supposedly allows users to find driving ...
3
votes
2answers
356 views

Google Chrome extension wants to be able to “manage apps, extensions…”: reasonable?

One image can tell more than a thousand words... Is what this extension is asking for reasonable? There are (at least?) five actions it is requesting permission that I do not see what it would need ...
11
votes
1answer
1k views

Danger of browser extension without any permissions?

Assuming that an extension for Firefox or Chrome does not request any WebExtensions permission, what harm could this extension do? Or put another way: What (potentially malicious) actions can an ...
1
vote
0answers
137 views

Do WebEx's requirements open security holes?

After a WebEx presentation is recorded, the recording cannot be played in-browser without installing a browser extension that requires invasive permissions to access the user's data for all websites: ...
3
votes
1answer
131 views

Is it possible for page to get your installed extensions through javascript?

When you visit a page, could that page tell what extensions you are running if javascript is enabled? If so then could we stop them or at least make it extremely difficult to increase our privacy?
3
votes
1answer
206 views

Aren't browser extensions a critical security risk?

Lately, there was a lot of publicity given to such exotic security risks as Spectre and Meltdown, with immediate Pavlov reactions from Microsoft, Mozilla etc. However recently I came upon the (...
2
votes
1answer
74 views

Why/how is browser inserting inline SVGs at end of body?

Chrome is inserting the following SVG images at the bottom of pages: <span style="width: 24px; height: 24px; background: url(&quot;data:image/svg+xml;base64,PD94bWwgdmVyc2lvbj0iMS4wIiA/...
2
votes
1answer
230 views

GET, “mailto” warning - how can I tell if a site is secure?

My password manager is giving me a warning when I go to certain sites. They say if I think I can trust the site to go ahead and use it .... this leaves me concerned I'll miss something. The pop-up ...
1
vote
1answer
35 views

What happens when a Firefox blocked extension is already installed and enabled/disabled?

Mozilla has been busy blocking Firefox extensions from their ecosystem due to security and privacy concerns. What happens when a blocked Firefox extension is already installed and enabled? What ...
1
vote
1answer
49 views

How do modern browsers isolate different addons?

A user may have multiple addons installed on a browser. But typically, the browser is running in userspace with an unprivileged uid. I was wondering how modern browsers can, in such a setting, provide ...
8
votes
2answers
251 views

How to choose Chrome extensions with security in mind

I find myself more and more in need of using Chrome extensions, but the appallingly broad and intrusive permission requirements prevent me from installing any of them. Pretty much every extension I ...
3
votes
1answer
63 views

Prevent reflecting page modified by browser extension

Suppose there is a trusted browser extension in a chrome browser that modifies the web page (like editing DOM, appending scripts, etc) I don't want anyone but me to see the page modified by this ...
2
votes
0answers
83 views

How to secure communication between page and browser extension?

In my browser plugin I want to detect any use of a built-in JavaScript function. I override this function by injecting a piece of code onto the page. This code then triggers an event, and an event ...
0
votes
0answers
55 views

Is authorizating add-ons in this way secure?

I have a website, for which I made accompanying add-on to Firefox and Chrome. Both of those are distributed privately. In Firefox they can be installed only from my website, and for Chrome the link to ...
0
votes
0answers
47 views

Are there known cases when malicious Javascript or Chrome/Firefox extension copied certificate from browser?

I have a certificate that must be manually installed on my browser in order to have a secure connection with a specific website. Are there known cases of malicious Javascript or Chrome/Firefox ...
2
votes
1answer
377 views

How do password managers implement secure browser integration? [closed]

Some password managers can automatically fill passwords in user's browser. But for this auto-fill to be secure, they have to make sure they are putting password in the correct input field, plus, the ...
3
votes
0answers
70 views

Is it possible to “polyfill” a vulnerable Flash player to a users machine when they visit a web page?

This is about the concept of adding "necessary code" to a webpage to ensure that any client can view the "content" provided through that page. This sort of code is sometimes referred to as a polyfill. ...
3
votes
2answers
71 views

Testing an untrusted browser extension securely on macOS

I have received a .zip file containg a browser extension for Google Chrome. How can I test this safely? Current options I consider: 1) Using a VM. Installing VirtualBox on my macos, and then running ...
64
votes
6answers
12k views

Are there objective reasons to not allow Google Chrome extensions, but to allow Firefox extensions?

Recently, the company I work for has forbidden usage of any extensions in Chrome. They also do not allow account sync. This affected virtually all Web developers since they use Chrome to test their ...
3
votes
1answer
166 views

Web browser account security

Please note that I've looked what similar questions have been addressed, but all I found was partial discussions. My concerns is about web browser, password managers, cookies and sessions. My goal ...
1
vote
0answers
269 views

Check if a Websocket connection origins from a Chrome extension [closed]

I am writing an application that communicates with a Chrome extension via websocket connection. I wonder if there is a way to detect whether the connection actually origins from the extension. The ...