After you, please: browser extensions order attacks and countermeasures

Abstract

Browser extensions are small applications executed in the browser context that provide additional capabilities and enrich the user experience while surfing the web. The acceptance of extensions in current browsers is unquestionable. For instance, Chrome's official extension repository has more than 63,000 extensions, with some of them having more than 10M users. When installed, extensions are pushed into an internal queue within the browser. The order in which each extension executes depends on a number of factors, including their relative installation times. In this paper, we demonstrate how this order can be exploited by an unprivileged malicious extension (i.e., one with no more permissions than those already assigned when accessing web content) to get access to any private information that other extensions have previously introduced. Our solution does not require modifying the core browser engine as it is implemented as another browser extension. We prove that our approach effectively protects the user against usual attackers (i.e., any other installed extension) as well as against strong attackers having access to the effects of all installed extensions (i.e., knowing who did what). We also prove soundness and robustness of our approach under reasonable assumptions.

A survey of challenges for runtime verification from advanced application domains (beyond software)

“…Recent works [269] demonstrates empirically that this order could be exploited by an unprivileged malicious extension (i.e., one with no more permissions than those already assigned when accessing web content) to get access to any private information that other extensions have previously introduced. To the best of our knowledge, there still is no solution to this problem.…”

First, Do No Harm: Studying the manipulation of security headers in browser extensions

“…As much as it helps to discover the characteristics of every extension separately, it does not provide a view on the sideeffects of communication-channel and potential collusion that may exist between multiple extensions installed at the client. Picazo-Sanchez et al [28] further showed that the browser decides the execution order of each extension based on their registered event listeners and installation timestamp, which may cause unintended security issues at the client. Since it is infeasible to analyze the collusion pattern among every combination of extensions, we aim to identify those that are externally-connectable and clusters based on their functionalities and installations to detect any potential collusion pattern arising from the union of their respective privileges.…”