Google’s Enhanced Chrome Store Review Process Thwarted by Sneaky Data-Stealer

Malicious Browser Extensions Can Still Infiltrate Google Chrome Web Store Despite Security Measures

A Persistent Threat

Researchers from the University of Wisconsin-Madison have discovered that even though Google Chrome has adopted Manifest V3, its latest security and privacy standard, malicious browser extensions can still make their way into the Chrome Web Store. This finding poses a significant threat as these extensions have the potential to steal passwords and other sensitive data. The extension developed by the researchers successfully passed the Chrome Web Store review process despite compliance with Manifest V3.

The Balancing Act of Manifest V3

Manifest V3 is aimed at striking a balance between allowing browser extensions the necessary access to function effectively while also preventing malicious extensions from gaining the same access. The standard enhances security measures, particularly by preventing extensions from downloading code from external websites. This restriction ensures that extensions cannot change their behavior or functionality after installation, giving Google a chance to assess an extension’s purpose before allowing it in the Chrome store.

Uncovering the Vulnerabilities

The University of Wisconsin-Madison researchers identified two vulnerabilities in input fields, one of which revealed passwords in plaintext within the HTML source code of web pages. Despite Manifest V3’s adoption, the interaction between extensions and web pages has not fundamentally changed. Extensions can still access the complete contents of web pages, including sensitive information entered in text input fields.

The researchers disguised their extension as a chat assistant with GPT-like functions, gaining permission to run on all websites. Once the extension passed the review process, it employed three attacks: source extraction, value attack, and element substitution. These attacks enable the copying of sensitive values from input fields, the selection and reading of target input fields, and the bypassing of JavaScript-based obfuscation.

Browser Extensions and Their Wide Access

The success of these browser attacks hinges on the vast access that extensions have to the Document Object Model (DOM) of every webpage. The DOM is a representation of a webpage’s structure in computer memory that can be accessed and modified, allowing for real-time changes to the page. This extensive access grants extensions significant power, including the ability to read or modify text input fields where users enter passwords.

The researchers found that most of the top 10,000 websites, including popular ones like Google, Facebook, Gmail, Cloudflare, and Amazon, are vulnerable to these attacks. Furthermore, approximately 12.5% of extensions possess the necessary permissions to exploit these vulnerabilities. The researchers identified 190 extensions with direct access to password fields, emphasizing the widespread nature of the issue.

Protecting Sensitive Browser Data

An Ongoing Battle

Malicious browser extensions pose a substantial risk not only to Google Chrome but to all browsers. Studies reveal that over half of all installed browser extensions are high risk and have the potential to cause significant damage to organizations relying on them.

Possible Countermeasures

To address the vulnerabilities uncovered in their research, the Wisconsin-Madison researchers propose two countermeasures: a “bolt-on” solution and a “built-in” solution.

The “bolt-on” solution suggests implementing a JavaScript package that website developers can integrate into their code to protect sensitive input fields. This package would provide an additional layer of security against extension attacks.

On the other hand, the “built-in” solution would involve implementing an alert at the browser level. This alert would notify users when an extension accesses sensitive input fields, both during selection and when the value within the field is read. This approach offers a timely warning to users about potential security risks.

Editorial: The Ongoing Struggle for Browser Security

The continued presence of malicious browser extensions highlights the persistent challenges of maintaining internet security. Despite advancements in security standards like Manifest V3, attackers find ways to exploit vulnerabilities and infiltrate official app stores.

The responsibility to strengthen security measures extends to both browser developers and extension creators. Browser developers should continuously assess and enhance their security standards, leaving no room for attackers to exploit loopholes. Extension creators, on the other hand, must prioritize user trust and ensure that their products adhere to strict security protocols.

However, individual users also bear a crucial responsibility. It is essential to exercise caution when installing extensions and only choose those from reputable sources that have undergone rigorous review processes.

Conclusion

The threat of malicious browser extensions persists even with the adoption of enhanced security measures in Google Chrome. Developers, both of browsers and extensions, must remain vigilant in their efforts to safeguard user data. At the same time, users must exercise caution and choose extensions with care. By combining these efforts, we can improve internet security and protect sensitive information from falling into the wrong hands.