Are chrome extensions compliant with the spirit of least privilege?

Picazo-Sanchez, Pablo; Ortiz-Martin, Lara; Schneider, Gerardo; Sabelfeld, Andrei

doi:10.1007/s10207-022-00610-w

Cited by 3 publications

(1 citation statement)

References 21 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…A critical challenge for a responsible app repair framework is the threat of malicious patches. Greasemonkey's script market su ered from a signi cant number of malicious scripts disguised as benign scripts with abusable vulnerabilities [85,110]. Though there have been recent developments in automated malware detection [21,62,67,74,105,118,121], automated approaches might not be su ciently reliable to mitigate the threat of malicious patches [22,23,35,57].…”

Section: Risks and Challengesmentioning

confidence: 99%

‘We are adults and deserve control of our phones’: Examining the risks and opportunities of a right to repair for mobile apps

Kollnig

Datta

Davier

et al. 2023

2023 ACM Conference on Fairness, Accountability, and Transparency

View full text Add to dashboard Cite

Many mobile apps are designed not just to support end-users' needs, but also commercial aims. This can result in app designs that compromise end-user privacy, safety, and well-being. Since apps nowadays provide vital digital information and services, users often have no choice but to accept potentially harmful or manipulative app designs. What if, instead, individuals could customise their apps to make them safer and better suit their needs? This exploratory work examines this question through a multi-faceted approach; rst, to understand user needs, we conducted a survey (𝑛 = 100) of changes users wanted in their apps, and of perceptions of risks in app repair. Second, to identify technical challenges, we developed a prototype that enables end-users to change their apps, and realised several modi cations suggested by survey participants. Finally, we conduct a set of expert interviews (𝑛 = 8) to delve into the ethical and legal aspects of such a tool, and synthesise a framework of risks and opportunities of app repair. CCS CONCEPTS• Human-centered computing → Empirical studies in ubiquitous and mobile computing; • Security and privacy → Software and application security.

show abstract

Section: Risks and Challengesmentioning

confidence: 99%

‘We are adults and deserve control of our phones’: Examining the risks and opportunities of a right to repair for mobile apps

Kollnig

Datta

Davier

et al. 2023

2023 ACM Conference on Fairness, Accountability, and Transparency

View full text Add to dashboard Cite

show abstract

From Manifest V2 to V3: A Study on the Discoverability of Chrome Extensions

Bucci,

2023

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Browser extensions allow users to customise and improve their web browsing experience. The Manifest protocol was introduced to mitigate the risk of accidental vulnerabilities in extensions, introduced by inexperienced developers. In Manifest V2, the introduction of webaccessible resources (WARs) limited the exposure of extension files to web pages, thereby reducing the potential for exploitation by malicious actors, which was a significant risk in the previous unrestricted access model. Building on this, Manifest V3 coupled WARs with match patterns, allowing extension developers to precisely define which websites can interact with their extensions, thereby limiting unintended exposures and reducing potential privacy risks associated with websites detecting user-installed extensions. In this paper, we investigate the impact of Manifest V3 on WAR-enabled extension discovery by providing an empirical study of the Chrome Web Store. We collected and analysed 108,416 extensions and found that Manifest V3 produces a relative reduction in WAR detectability ranging between 4% and 10%, with popular extensions exhibiting a higher impact. Additionally, our study revealed that 30.78% of extensions already transitioned to Manifest V3. Finally, we implemented X-Probe, a live demonstrator showcasing WAR-enabled discovery. Our evaluation shows that our demonstrator can detect 22.74% of Manifest V2 and 18.3% of Manifest V3 extensions. Moreover, within the 1000 most popular extensions, the detection rates rise to a substantial 58.07% and 47.61%, respectively. In conclusion, our research shows that developers commonly associate broad match patterns to their WARs either because of poor security practices, or due to the inherent functional requirements of their extensions.

show abstract

Safeguard confidential web information from malicious browser extension using Encryption and Isolation techniques

Marimuthu¹,

Mohanraj

Karthikeyan

et al. 2023

IFS

View full text Add to dashboard Cite

Web browsers have become an integral part of our daily lives, granting us access to vast information and services. However, this convenience significantly risks personal information and data security. One common source of this risk is browser extensions, which users often employ to add new features to their browsers. Unfortunately, these extensions can also pose a security threat, as malicious ones may access and steal sensitive information such as passwords, credit card details, and personal data. The vulnerability of web browsers to malicious extensions is a significant challenge that effectively tackles through robust defence mechanisms. To address this concern, Secure Vault – API is proposed and designed to safeguard confidential web page content from malicious extensions. The Web Crypto API provides cryptographic functions that protect data during transmission and storage. The Secure Vault encompasses a Sentinel extension responsible for parsing the web page’s Document Object Model (DOM) content and querying for all “vault” elements. The extension then verifies that the DOM content has not been tampered with by any malicious extension by calculating the SHA512 hash value of the concatenated vault elements as a string, with no whitespace between them. With its encryption, hashing, and isolation techniques, the Secure Vault effectively protects confidential web page content from malicious extensions. It provides a secure environment for storing and processing sensitive data, reducing the risk of data breaches caused by malicious extensions. The proposed approach offers significant advantages over existing strategies in terms of protecting confidential web page content from malicious extensions. This not only improves the efficiency and effectiveness of the browser extensions but also ensures compatibility, interoperability and performance across different web browsers with respect to the load time of HTML elements. Users can browse the web and carry out sensitive transactions with peace of mind, knowing their data is safeguarded against theft or manipulation by malicious extensions.

show abstract

Are chrome extensions compliant with the spirit of least privilege?

Cited by 3 publications

References 21 publications

‘We are adults and deserve control of our phones’: Examining the risks and opportunities of a right to repair for mobile apps

‘We are adults and deserve control of our phones’: Examining the risks and opportunities of a right to repair for mobile apps

From Manifest V2 to V3: A Study on the Discoverability of Chrome Extensions

Safeguard confidential web information from malicious browser extension using Encryption and Isolation techniques

Contact Info

Product

Resources

About