can google chrome extensions be dangerous

Finally, we collect the latest data set and carry out experiments on the actual scenario where users install multiple extensions.

Second, we design BEFP, an extension recognition system which comprehensively utilizes the above two technologies to improve the uniqueness of the extension fingerprint. They, respectively, capture the operation behaviors of extensions on JavaScript properties and webpage’s DOM. In this paper, we first propose two extension fingerprinting technologies: JavaScript-based environmental fingerprinting and DOM-based behavioral fingerprinting. However, the proposal of various defense measures weakens the effectiveness of the existing extension fingerprinting technologies. Previous studies have shown that browser extension fingerprinting can be used to track users and reveal users’ privacy information by obtaining the browser extension list. We propose and evaluate additional de-fenses, and we conclude that banning HTTP scripts and inline scripts would prevent 47 of the 50 most severe vul-nerabilities with only modest impact on developers.īrowser extensions are third-party applications that can customize the browsing experience. We find that the mechanisms mostly succeed at preventing web attacks, but new security mechanisms are needed to protect users from network attacks on extensions, website metadata at-tacks on extensions, and vulnerabilities that extensions add to websites. Given these vulnerabilities, we evaluate how well each of the security mechanisms de-fends against extension vulnerabilities. We performed a security review of 100 Chrome extensions and found 70 vulnerabilities across 40 extensions. In 2009, Google Chrome intro-duced a new extension platform with several features intended to prevent and mitigate extension vulnerabili-ties: strong isolation between websites and extensions, privilege separation within an extension, and an exten-sion permission system. Ex-tensions can also introduce vulnerabilities into the web-sites that they modify. Vulnerabilities in browser extensions put users at risk by providing a way for website and network attackers to gain access to users' private data and credentials.

Can google chrome extensions be dangerous