It’s a trust issue, there’s no getting round it Sounds ominous, doesn’t it? So, let’s set things straight. This maintains the lack of security boundary between the extension and web page and allows an extension to be loaded on the DOM tree and gain unrestricted access to the webpage, posing security risks for the users.” They said: “Despite MV3’s intended advancements in user privacy and security, content scripts’ operations remain unchanged. While Google Chrome’s new platform for extensions, Manifest V3, has imposed constraints on what extensions can do, the researchers found that these measures did not mitigate risks to security in any substantial way. “Analyzing the manifest files (the JSON-formatted files that provide important information about the extension’s capabilities and the files it uses), we find that 12.5% (17.3K) extensions have the necessary permissions to extract sensitive information on all web pages.” During their research, they identified 190 extensions that were “directly accessing password fields,” including such popular extensions as AdBlockPlus and Honey - both of them boasting over 10 million downloads. The researchers found that on 15% of the websites they studied - and these are not some obscure and unknown portals, but the likes of Google and Cloudflare (among others) - passwords were “present in plain text in the HTML source code.” In the researchers’ opinion, this careless attitude by website developers combined with relatively lax Chrome rules for extension developers leave the door wide open for attackers to exploit this vulnerability.
These unprotected passwords, they argue, can become easy targets for malicious data-hungry extensions.
#Adguard extension for chrome android code#
The paper mainly focuses on passwords that the researchers say are often stored in plaintext within the source code of even reputable websites.
Recent research by the University of Wisconsin-Madison found that “a significant percentage” of extensions in Chrome - about 12.5% - have received permissions from users that enable them to access sensitive personal information.
0 kommentar(er)
