All Questions
Tagged with chrome browser-extensions
51 questions
21
votes
2
answers
4k
views
Could a Google Chrome extension read my password?
I am concerned about the security of my passwords while using Google Chrome extensions. Specifically, I'd like to know if it's possible for a Chrome extension to read passwords that I enter on ...
- 321
2
votes
2
answers
491
views
How to do auth without user interaction in an enterprise environment?
We are building a Chrome Extension that will be force-installed on each employee's browser for the companies we work with.
We currently use OAuth but many employees are forgetting to sign up.
We are ...
- 121
1
vote
1
answer
201
views
Chrome extensions: tool to notify users of ownership change (to avoid malicious code injection)? [closed]
A problem with Chrome extensions was raised in an earlier question: extension owners can sell their extension to another owner, who can then insert malicious code.
From a user's perspective, they may ...
- 111
0
votes
0
answers
24
views
Practical ways to tell if a Chrome extension is safe? [duplicate]
After reading about Emails a browser extension developer gets from scammers (and the comments here) I understand that there are people who try to convince good addon developers to introduce shady (or ...
- 1,320
5
votes
0
answers
696
views
Can Chrome extensions access other Chrome extensions' data?
Can the data in a password-manager Chrome extension be accessed by a different Chrome extension? For example, if one were to install a malicious extension, could that extension access the data (i.e., ...
- 51
2
votes
0
answers
282
views
What is the threat-model of a malicious browser-extension accessing the data of *another browser-extension* that is security-critical?
Modern password-managers are moving towards a "fully-in-the-browser" model (see: historical RCE on LastPass, and now 1Password is also moving towards 1Password X as "the future" ...
- 285
0
votes
1
answer
250
views
Is JQuery in chrome extension a security concern?
This is the relevant part of my manifest.json file:
"content_scripts": [
{
"css": ["style.css"],
"matches": [
"<all_urls>&...
- 103
1
vote
1
answer
498
views
Chrome extension security
I want to install a Chrome extension called metamask. I do not trust this kind of software. (Maybe because I am a newbie)
What can a Chrome extension do on my computer? Is it possible, for example, ...
- 51
0
votes
0
answers
11
views
Chrome Malware, Redirects To Ad When I Click Link in Google? [duplicate]
I've been dealing with this Chrome malware for awhile now, and I can't identify where it's coming from. Very occasionally, when I click on a top link in Google, it'll redirect me to a site that looks ...
32
votes
5
answers
7k
views
How do I know if a Google Chrome extension is leaking data?
Many Google Chrome extensions require permissions to read the contents of webpages the user visits. How can the user verify whether and to what extent a certain Chrome extension leaks data?
- 1,680
38
votes
1
answer
7k
views
Can a browser extension (Chrome, Firefox, etc.) read the web console log?
I realized that my bank handles sensitive information in the web console log, so my concern is if any browser extension could read the log?
- 499
8
votes
3
answers
2k
views
Browser setups to stay safe from malware and unwanted stuff
I have to set up a browser to surf the internet. I'm trying to stay safe from malware as much as possible. (I already know that there's no way to stay 100% safe.)
My idea is to use Firefox with these ...
- 83
0
votes
1
answer
326
views
Blocking Standard Users (Win 10) from Adding Chrome Extensions
I want to block standard users (Win 10) from adding Chrome extensions. When the standard user renames the default folder, it overwrites any security policies applied on the Extensions folder.
1
vote
1
answer
2k
views
Installed sketchy Chrome extension - Potential malware infection?
So... Tired me was browsing through Ikea's website this morning and tried to use one of their visualisation tool. Got an error message saying that I was not running the lastest version of Adobe Flash. ...
- 25
0
votes
1
answer
9k
views
Bitdefender showing lot of Getting Suspicious Connection Blocked from Chrome extension Toby
I'm using GetToby Chrome extension to manage my tabs and save them for later. Lately, I've been getting lots of notifications from BitDefender about blocked suspicious attempt:
chrome.exe attempted ...
- 101
3
votes
2
answers
777
views
Google Chrome extension wants to be able to "manage apps, extensions...": reasonable?
One image can tell more than a thousand words...
Is what this extension is asking for reasonable?
There are (at least?) five actions it is requesting permission that I do not see what it would need ...
11
votes
1
answer
1k
views
Danger of browser extension without any permissions?
Assuming that an extension for Firefox or Chrome does not request any WebExtensions permission, what harm could this extension do?
Or put another way: What (potentially malicious) actions can an ...
- 29.8k
2
votes
1
answer
155
views
Why/how is browser inserting inline SVGs at end of body?
Chrome is inserting the following SVG images at the bottom of pages:
<span style="width: 24px; height: 24px; background: url("data:image/svg+xml;base64,PD94bWwgdmVyc2lvbj0iMS4wIiA/...
- 121
8
votes
2
answers
394
views
How to choose Chrome extensions with security in mind
I find myself more and more in need of using Chrome extensions, but the appallingly broad and intrusive permission requirements prevent me from installing any of them.
Pretty much every extension I ...
- 83
3
votes
1
answer
157
views
Prevent reflecting page modified by browser extension
Suppose there is a trusted browser extension in a chrome browser that modifies the web page (like editing DOM, appending scripts, etc)
I don't want anyone but me to see the page modified by this ...
- 387
3
votes
2
answers
157
views
Testing an untrusted browser extension securely on macOS
I have received a .zip file containg a browser extension for Google Chrome.
How can I test this safely? Current options I consider:
1) Using a VM. Installing VirtualBox on my macos, and then running ...
- 139
64
votes
6
answers
13k
views
Are there objective reasons to not allow Google Chrome extensions, but to allow Firefox extensions?
Recently, the company I work for has forbidden usage of any extensions in Chrome. They also do not allow account sync. This affected virtually all Web developers since they use Chrome to test their ...
- 2,193
1
vote
0
answers
460
views
Check if a Websocket connection origins from a Chrome extension [closed]
I am writing an application that communicates with a Chrome extension via websocket connection. I wonder if there is a way to detect whether the connection actually origins from the extension. The ...
- 252
1
vote
1
answer
3k
views
Can my computer be compromised by uBlock/Adblock filter list?
uBlock is open source and suppose I trust the author. But filter lists are something that is maintained by other people. Is it possible to add something to a filter list to compromise computer/browser,...
- 715
8
votes
4
answers
1k
views
What are the effects of the Chrome Web Developer extension hijack?
Today, the owner of the rather popular Web Developer toolbar noticed it had been hijacked and replaced with a malicious version. He disabled it, but the malicious version (diff) had been in the wild ...
- 2,993
0
votes
1
answer
387
views
Help! What is this remote takeover / malware from a pop up, and what does it do? [duplicate]
I was recently on yts.pe a torrent distribution site. When I clicked on a torrent, there was a pop up, which Chrome totally didn't block, even though it is set to block all pop-ups.
Here are the ...
6
votes
1
answer
466
views
Prevent Chrome extensions from betraying me
As has been discussed in this answer, a flaw with the Chrome Web Store is that an honest-but-naive developer may sell a popular browser extension to someone like Techno SoLotions, assuming that Techno ...
- 2,120
3
votes
1
answer
218
views
How secure is our privacy when using third party addons and extensions?
I use many addons and extensions in my browsers some of it is for ad blocking, taking screen shots and VPNs. This question came to my mind while using free VPN addons. I usually uses VPN addons for ...
- 569
5
votes
2
answers
738
views
LastPass vulnerability: Should LastPass users change all their passwords?
Reading about the recent vulnerability in LastPass extensions for FireFox and Chrome. The published exploit allows arbitrary code execution. The vulnerability also allowed access to stored passwords. ...
- 6,923
1
vote
1
answer
2k
views
Chrome users and malicious extensions
I have 2 users in Chrome. One is used for personal purposes has gmail box, google disk, etc. The second one is "business" user who has another configuration, it's own gmail, google disk, etc.
Let's ...
- 687
2
votes
1
answer
258
views
Plugins to increase security of Chrome? [closed]
What plugins are there for Chrome, that would increase security while browsing the web?
For Firefox I have used NoScript, Flashblock, and AdBlock Plus, are there equivalents to these plugins for ...
- 157
2
votes
2
answers
2k
views
Is Chromebleed still needed?
I've been running 'Chromebleed' for years now ... is it still needed? The latest advice I've found on various sites is now over 18 months old.
- 21
2
votes
1
answer
536
views
Is it normal for Chrome extensions to demand too many permission?
I tried to install a Chrome extension for downloading Facebook video clips, but it requests too many privileges in my opinion:
Read and change all your data on the websites you visit
Manage ...
- 233
1
vote
1
answer
155
views
Protecting users with browser extension. Is it possible, if the machine is already infected?
Assume a trojan acquired admin privilege on a Windows 7 machine.
How easy is it for the trojan to replace/hijack/modify a browser extension without user knowing it? Is it possible?
I am thinking of ...
- 243
4
votes
3
answers
369
views
Addons in Chrome
When installing any add on in Chrome, a set of permissions is needed to be granted to the add on. Many addons(including popular ones like Pocket and Adblock) have Read and change all the data on the ...
- 613
1
vote
0
answers
337
views
How to know which extension or software is causing ads in Chrome? [closed]
Starting yesterday, I noticed that something weird is going on with my laptop. After unlocking my laptop I found that the empty Chrome pages that I opened are getting redirected to ads. I am running ...
- 49
3
votes
0
answers
6k
views
Does this list every Chrome extension/addin that may leak privacy?
I am looking for a simple list of all extensions, preference, custom processes, and "flags" that may disclose a user's privacy or other details to a 3rd party.
To that end, I discovered: chrome://net-...
- 51.1k
2
votes
2
answers
3k
views
Are Chrome extensions like Advanced REST Client safe to use?
I'm just getting into learning REST and came across this great application that instantly lets me test out requests (Advanced Rest Client). The question arose that since it is an extension to the ...
- 121
17
votes
6
answers
129k
views
How to prevent installation of Google Chrome extensions
How can I prevent the installation of Chrome extensions on desktop?
- 319
2
votes
0
answers
24k
views
Chrome opening and immediately closing a tab after clicking SOME links [closed]
A few days ago I installed OSX 10.8 on a clean disk, and moved some of the old apps and data form the old to the new one.
I've noticed that Chrome exibited an odd behaviour: when clicking some links, ...
- 726
2
votes
2
answers
3k
views
Firefox vs. Chrome extensions: Which are---ceteris paribus---more secure?
As an 'extension' to earlier questions on this topic (for instance here and here),
What makes Firefox extensions (appear) more secure than Chrome extensions?
Do they just appear to be more secure, or ...
8
votes
2
answers
5k
views
Is Google Chrome Extension access to SSL certificate validation output possible?
I want to develop an extension which will stop an user from proceeding to any banking site (configurable by user) if a proxy like paros is seating in between sending fake certificate to user. My ...
- 1,507
3
votes
2
answers
4k
views
Do Chrome/browser extensions break the tab sandbox?
So, as far as I know, Chrome and possibly other browsers have a very low privilege process spawned for every tab.
How do browser extensions interact in regard to this sandboxing? I'm not talking ...
- 1,070
19
votes
1
answer
11k
views
Is Vimium (Chrome extension) really safe?
I really like the Chrome extension Vimium. It significantly speeds up surfing for power users. However, when you install it, Chrome warns you because this extension injects JS code on every page you ...
- 293
2
votes
2
answers
800
views
Injecting information in a web page (Gmail). Does it raise security problem?
I am developing a Google Chrome extension which encrypts/decrypts emails for Gmail users. So, I detect encrypted emails when the user opens an email on using tags. Once an encrypted email has been ...
- 137
32
votes
3
answers
5k
views
Are official browser add-ons really safe?
Almost any browser addon/extension that I install on my Chrome or Firefox (be it Firebug, RESTClient, ...) warns me, saying:
It [the add-on] can:
Access your data on all website
Access ...
- 841
12
votes
3
answers
5k
views
Any tool for scanning vulnerabilities in browser extensions? [closed]
I am scanning browser extensions of Chrome and Firefox for vulnerabilities. Is there any tool which would help me do this?
- 4,372
84
votes
2
answers
28k
views
Worst case scenario, what can a Chrome extension do with "Your data on all websites" and "Your tabs and browsing activity"?
Chrome extensions, and just like other browsers, appear to often get quite some extensive access to your browser data. In fact, most extensions I've installed require access to:
Your data on all ...
- 1,285
10
votes
1
answer
2k
views
How do I check the code of a Chrome extension to make sure it's not stealing my info?
I've been reading more and more about just how much access browser extensions can have to your data. This is a little unsettling, so I'm curious if there is a way to Vet these extensions and make sure ...
- 1,771
24
votes
2
answers
4k
views
Why do Chrome extensions need access to 'all my data' and 'browsing activity'?
Often I install simple add-ons for Google Chrome. However, they almost all need what appears to me as excessive access to my data. For instance, I install an extension that allows me to click on any ...
user5672