Questions tagged [browser-extensions]
Browser extensions are additions to a web browser that provide extra functionality.
175 questions
0
votes
1
answer
9k
views
Bitdefender showing lot of Getting Suspicious Connection Blocked from Chrome extension Toby
I'm using GetToby Chrome extension to manage my tabs and save them for later. Lately, I've been getting lots of notifications from BitDefender about blocked suspicious attempt:
chrome.exe attempted ...
- 101
23
votes
2
answers
19k
views
Is Stylish safe to use again?
Stylish is/was a very popular extension for the Chrome and Firefox web browsers, which let users add custom styles to certain websites. I was using it myself, until a helpful fellow told me it was ...
- 2,285
0
votes
1
answer
203
views
Why are there no browser feature or extension to only check the domain and username to prevent phishing?
One of the recommendations to prevent phishing using look-alike domain names (like www.google.com.phishing.org or IDN homograph attacks) is to use a password manager or a physical security token like ...
- 183
2
votes
1
answer
202
views
I found a browser extension I don't trust installed, should I worry?
Someone told me that their Firefox had a strange new menu bar.
I found that it was “FindYourMaps”.
FindYourMaps is a deceptive browser toolbar that supposedly allows users to find driving ...
- 300
3
votes
2
answers
777
views
Google Chrome extension wants to be able to "manage apps, extensions...": reasonable?
One image can tell more than a thousand words...
Is what this extension is asking for reasonable?
There are (at least?) five actions it is requesting permission that I do not see what it would need ...
11
votes
1
answer
1k
views
Danger of browser extension without any permissions?
Assuming that an extension for Firefox or Chrome does not request any WebExtensions permission, what harm could this extension do?
Or put another way: What (potentially malicious) actions can an ...
- 29.8k
1
vote
0
answers
277
views
Do WebEx's requirements open security holes?
After a WebEx presentation is recorded, the recording cannot be played in-browser without installing a browser extension that requires invasive permissions to access the user's data for all websites:
...
- 11
4
votes
1
answer
2k
views
Is it possible for page to get your installed extensions through javascript?
When you visit a page, could that page tell what extensions you are running
if javascript is enabled?
If so then could we stop them or at least make it extremely difficult to increase our privacy?
3
votes
1
answer
497
views
Aren't browser extensions a critical security risk?
Lately, there was a lot of publicity given to such exotic security risks as Spectre and Meltdown, with immediate Pavlov reactions from Microsoft, Mozilla etc. However recently I came upon the (...
- 149
2
votes
1
answer
155
views
Why/how is browser inserting inline SVGs at end of body?
Chrome is inserting the following SVG images at the bottom of pages:
<span style="width: 24px; height: 24px; background: url("data:image/svg+xml;base64,PD94bWwgdmVyc2lvbj0iMS4wIiA/...
- 121
2
votes
1
answer
671
views
GET, "mailto" warning - how can I tell if a site is secure?
My password manager is giving me a warning when I go to certain sites. They say if I think I can trust the site to go ahead and use it .... this leaves me concerned I'll miss something.
The pop-up ...
- 31
1
vote
1
answer
128
views
What happens when a Firefox blocked extension is already installed and enabled/disabled?
Mozilla has been busy blocking Firefox extensions from their ecosystem due to security and privacy concerns.
What happens when a blocked Firefox extension is already installed and enabled?
What ...
- 3,174
1
vote
1
answer
159
views
How do modern browsers isolate different addons?
A user may have multiple addons installed on a browser. But typically, the browser is running in userspace with an unprivileged uid. I was wondering how modern browsers can, in such a setting, provide ...
- 1,693
8
votes
2
answers
394
views
How to choose Chrome extensions with security in mind
I find myself more and more in need of using Chrome extensions, but the appallingly broad and intrusive permission requirements prevent me from installing any of them.
Pretty much every extension I ...
- 83
3
votes
1
answer
157
views
Prevent reflecting page modified by browser extension
Suppose there is a trusted browser extension in a chrome browser that modifies the web page (like editing DOM, appending scripts, etc)
I don't want anyone but me to see the page modified by this ...
- 387
2
votes
0
answers
325
views
How to secure communication between page and browser extension?
In my browser plugin I want to detect any use of a built-in JavaScript function. I override this function by injecting a piece of code onto the page. This code then triggers an event, and an event ...
- 34.4k
0
votes
0
answers
134
views
Is authorizating add-ons in this way secure?
I have a website, for which I made accompanying add-on to Firefox and Chrome. Both of those are distributed privately. In Firefox they can be installed only from my website, and for Chrome the link to ...
- 3,843
0
votes
0
answers
122
views
Are there known cases when malicious Javascript or Chrome/Firefox extension copied certificate from browser?
I have a certificate that must be manually installed on my browser in order to have a secure connection with a specific website.
Are there known cases of malicious Javascript or Chrome/Firefox ...
- 115
2
votes
1
answer
735
views
How do password managers implement secure browser integration? [closed]
Some password managers can automatically fill passwords in user's browser. But for this auto-fill to be secure, they have to make sure they are putting password in the correct input field, plus, the ...
- 1,693
2
votes
0
answers
154
views
Is it possible to "polyfill" a vulnerable Flash player to a users machine when they visit a web page?
This is about the concept of adding "necessary code" to a webpage to ensure that any client can view the "content" provided through that page. This sort of code is sometimes referred to as a polyfill.
...
- 131
3
votes
2
answers
157
views
Testing an untrusted browser extension securely on macOS
I have received a .zip file containg a browser extension for Google Chrome.
How can I test this safely? Current options I consider:
1) Using a VM. Installing VirtualBox on my macos, and then running ...
- 139
64
votes
6
answers
13k
views
Are there objective reasons to not allow Google Chrome extensions, but to allow Firefox extensions?
Recently, the company I work for has forbidden usage of any extensions in Chrome. They also do not allow account sync. This affected virtually all Web developers since they use Chrome to test their ...
- 2,193
3
votes
1
answer
242
views
Web browser account security
Please note that I've looked what similar questions have been addressed, but all I found was partial discussions.
My concerns is about web browser, password managers, cookies and sessions.
My goal ...
- 131
1
vote
0
answers
460
views
Check if a Websocket connection origins from a Chrome extension [closed]
I am writing an application that communicates with a Chrome extension via websocket connection. I wonder if there is a way to detect whether the connection actually origins from the extension. The ...
- 252
1
vote
0
answers
163
views
Can websites collect browser data without using http requests? [closed]
Is it possible for a website to collect data such as the plugins/fonts installed without sending it thought http requests?
If so, is there any plugin for any browser that tells the user what type of ...
- 111
2
votes
1
answer
432
views
How do I tell whether my browser extensions leak personal data?
According to the article Warning: Your Browser Extensions Are Spying On You:
Browser add-ons for Chrome, Firefox, and probably other browsers are tracking every single page you visit and sending that ...
- 1,956
1
vote
1
answer
3k
views
Can my computer be compromised by uBlock/Adblock filter list?
uBlock is open source and suppose I trust the author. But filter lists are something that is maintained by other people. Is it possible to add something to a filter list to compromise computer/browser,...
- 715
8
votes
4
answers
1k
views
What are the effects of the Chrome Web Developer extension hijack?
Today, the owner of the rather popular Web Developer toolbar noticed it had been hijacked and replaced with a malicious version. He disabled it, but the malicious version (diff) had been in the wild ...
- 2,993
2
votes
1
answer
134
views
How can I programatically keep track of number of certificate warnings in browser?
I want to keep a count of how many certificate warnings have been made in the browser over a period of several weeks. I also want to keep track of whether the user ignored these warnings and just ...
- 1,576
1
vote
1
answer
175
views
Go.redirectro issue [closed]
I have a hijacker problem "Go.redirectro"
And it gave ma a horrible headache
I tried registry editor and take a file by file deep look at my drive and uh god it took me long time
Look i am a ...
- 19
1
vote
2
answers
723
views
Password manager: master password or not?
I use several browsers for several reasons (surfing, downloading files, logging into accounts...) but I prefer Chrome for doing "risky" things like browsing websites which I don't know whether they ...
- 481
1
vote
1
answer
222
views
Should I use different browsers for surfing and logging into accounts?
I use web in different ways, i.e.:
a) to log into my accounts (email, google, social, forums, etc.);
b) for downloading softwares;
c) for surfing trusted websites;
d) for surfing websites which I don'...
- 481
2
votes
1
answer
791
views
TunnelBear VPN Chrome extension doesn't encrypt DNS Queries
I'm using a VPN provider in occurance TunnelBear and decided today to run Wireshark in parallel and found out that DNS resolutions are happening un-encrypted using OS default name resolution, e.g. ...
- 1,142
0
votes
1
answer
387
views
Help! What is this remote takeover / malware from a pop up, and what does it do? [duplicate]
I was recently on yts.pe a torrent distribution site. When I clicked on a torrent, there was a pop up, which Chrome totally didn't block, even though it is set to block all pop-ups.
Here are the ...
-1
votes
3
answers
237
views
How to protect your web application's data against an injected JavaScript?
I have a web application which interacts with two web servers. The response of the first one is stored temporarily on the browser (window.xyz=response.xyz) and when the user makes the request for ...
- 3,286
6
votes
1
answer
466
views
Prevent Chrome extensions from betraying me
As has been discussed in this answer, a flaw with the Chrome Web Store is that an honest-but-naive developer may sell a popular browser extension to someone like Techno SoLotions, assuming that Techno ...
- 2,120
1
vote
2
answers
2k
views
Block Pop Up window using Javascript code
When a user enters his credentials in the login form of a web application, the credentials can be hacked through a malicious extension (that the user has installed). Now, suppose the malicious ...
- 11
3
votes
1
answer
218
views
How secure is our privacy when using third party addons and extensions?
I use many addons and extensions in my browsers some of it is for ad blocking, taking screen shots and VPNs. This question came to my mind while using free VPN addons. I usually uses VPN addons for ...
- 569
70
votes
8
answers
18k
views
Why use HTTPS Everywhere when we have HSTS supported browsers?
I know that the browser's default protocol to access any site is http:// when https:// is explicitly not mentioned, but even then if we browse to a website say www.facebook.com, the response header ...
- 882
5
votes
2
answers
738
views
LastPass vulnerability: Should LastPass users change all their passwords?
Reading about the recent vulnerability in LastPass extensions for FireFox and Chrome. The published exploit allows arbitrary code execution. The vulnerability also allowed access to stored passwords. ...
- 6,923
1
vote
4
answers
181
views
To plugin or not to plugin?
Recently I did quite a research about internet browser related privacy. It hit me hard in the flesh myself, since I was part of the victims in the [WOT fiasco]1]. So I found out that usually way over ...
- 133
1
vote
1
answer
2k
views
Chrome users and malicious extensions
I have 2 users in Chrome. One is used for personal purposes has gmail box, google disk, etc. The second one is "business" user who has another configuration, it's own gmail, google disk, etc.
Let's ...
- 687
2
votes
1
answer
258
views
Plugins to increase security of Chrome? [closed]
What plugins are there for Chrome, that would increase security while browsing the web?
For Firefox I have used NoScript, Flashblock, and AdBlock Plus, are there equivalents to these plugins for ...
- 157
1
vote
1
answer
448
views
Browser custom protocol handlers
The possibility of running a shell command from an extension (NPAPI) has been phased out, but custom protocol handlers are still supported.
What is the practical difference if an extension can still ...
- 857
2
votes
1
answer
157
views
Malicious script compromising browser extensions
In Firefox or Chrome,
is it possible for a web page script to compromise a user installed extension?
This might involve access to extension private data or obtain the same execution privileges as ...
- 857
2
votes
2
answers
2k
views
Is Chromebleed still needed?
I've been running 'Chromebleed' for years now ... is it still needed? The latest advice I've found on various sites is now over 18 months old.
- 21
2
votes
4
answers
178
views
Plugin / extension security practices
What kind of common security practices do software developers apply when allowing extensions or plugins to be added to their software, like e.g. Firefox, Photoshop and GIMP do? It can be either on ...
- 23
3
votes
4
answers
581
views
Does blocking ads and deleting cookies improve privacy online?
I'm not sure if this is the right community for this kind of question, but here goes.
When I browse the web, here is what I do:
I always use uBlock
I usually use Self-Destructing Cookies to delete ...
- 257
5
votes
1
answer
4k
views
Chrome extension: Cross origin request
Can chrome extensions make cross-origin requests by injecting a javascript into the main page? If so, isn't it a security vulnerability?
Google Chrome Content Scripts
Cross Origin Requests
- 193
2
votes
5
answers
7k
views
How to be safe from browser-based key loggers?
A browser-based keylogger usually comes in the form of a browser extension. It logs any or specific data entered anywhere in the browser. The problem is that they do not get caught by the system's ...