Discovering Browser Extensions via Web Accessible Resources Alexander Sjösten Steven Van Acker Andrei Sabelfeld Chalmers University of Chalmers University of Chalmers University of Technology Technology Technology Gothenburg, Sweden Gothenburg, Sweden Gothenburg, Sweden
[email protected] [email protected] [email protected] ABSTRACT The first and second scenarios present an exclusive point Browser extensions provide a powerful platform to enrich of view of websites, concerned with malicious extensions. browsing experience. At the same time, they raise impor- The third scenario presents an exclusive view of extensions, tant security questions. From the point of view of a website, concerned with malicious websites. The fourth scenario illus- some browser extensions are invasive, removing intended fea- trates legitimate synergies between websites and extensions. tures and adding unintended ones, e.g. extensions that hi- Finally, the fifth scenario illustrates the security goals of jack Facebook likes. Conversely, from the point of view of websites and extensions at outright clash. extensions, some websites are invasive, e.g. websites that by- Bank scenario Bank webpages manipulate sensitive in- pass ad blockers. Motivated by security goals at clash, this formation whose unauthorized access may lead to financial paper explores browser extension discovery, through a non- losses. It is desirable to detect potentially insecure and vul- behavioral technique, based on detecting extensions' web ac- nerable extensions and prevent extensions from injecting cessible resources. We report on an empirical study with third-party scripts into the bank's webpages. The latter tech- free Chrome and Firefox extensions, being able to detect nique is in fact a common practice for many extensions [28, over 50% of the top 1,000 free Chrome extensions, including 31].