Lemmy.World

cross-posted from [email protected]

Original source: https://arxiv.org/pdf/2308.16321.pdf

• Researchers at the University of Wisconsin–Madison found that Chrome browser extensions can still steal passwords, despite compliance with Chrome's latest security standard, Manifest V3.
• A proof of concept extension successfully passed the Chrome Web Store review process, demonstrating the vulnerability.
• The core issue lies in the extensions' full access to the Document Object Model (DOM) of web pages, allowing them to interact with text input fields like passwords.
• Analysis of existing extensions showed that 12.5% had the permissions to exploit this vulnerability, identifying 190 extensions that directly access password fields.
• Researchers propose two fixes: a JavaScript library for websites to block unwanted access to password fields, and a browser-level alert system for password field interactions.

Original source: https://arxiv.org/pdf/2308.16321.pdf

• Researchers at the University of Wisconsin–Madison found that Chrome browser extensions can still steal passwords, despite compliance with Chrome's latest security standard, Manifest V3.
• A proof of concept extension successfully passed the Chrome Web Store review process, demonstrating the vulnerability.
• The core issue lies in the extensions' full access to the Document Object Model (DOM) of web pages, allowing them to interact with text input fields like passwords.
• Analysis of existing extensions showed that 12.5% had the permissions to exploit this vulnerability, identifying 190 extensions that directly access password fields.
• Researchers propose two fixes: a JavaScript library for websites to block unwanted access to password fields, and a browser-level alert system for password field interactions.

Summary

• Researchers at the University of Wisconsin–Madison have demonstrated that Chrome browser extensions can steal passwords from text input fields, even if the extension is compliant with Chrome's latest security and privacy standard, Manifest V3.

• They created a proof-of-concept browser extension that could steal passwords and put it through the Chrome Web Store review process.

• The attack works by exploiting the fact that extensions have full and unfettered access to the Document Object Model (DOM) of every web page you visit. The DOM is a representation of a web page in computer memory that can be accessed and changed, allowing the page to be modified on-the-fly.

• The researchers found that most of the top 10,000 websites are vulnerable to this attack, including Google, Facebook, Gmail, Cloudflare, and Amazon.

• They also analyzed the extensions already on the Chrome Web Store and found that 12.5% of them had the necessary permissions to exploit the password input field vulnerabilities.

• The researchers offer two potential fixes: A "bolt on" remedy for vulnerable sites and a "built in" remedy for browsers.

• The bolt on is a JavaScript library that can be added to websites to prevent unwanted access to password fields.

• The built in remedy suggests changing Chrome to alert users whenever any JavaScript function accesses any password fields.

Possible Takeaways / Other Details

• Google have improved security in the Manifest V3 standard, but it's still possible to sneak in a password stealing extension into the webstore.

• Some/all of the standard's security improvements may have also been adopted by Microsoft Edge, and Mozilla Firefox.

• It is important to be aware of the risks associated with using browsers' extensions. Only install extensions from trusted sources and carefully review the permissions that they request.