Hulk: Eliciting malicious behavior in browser extensions.

Alexandros Kapravelos, Chris Grier, Neha Chachra, Christopher Kruegel, Giovanni Vigna, and Vern Paxson.

Trends and lessons from three years fighting malicious extensions.

Nav Jagpal, Eric Dingle, Jean-Philippe Gravel, Panayiotis Mavrommatis, Niels Provos, Moheeb Abu Rajab, and Kurt Thomas.

Initial Assignment for the Content Security Policy Directives Registry. In International Conference on Detection of Intrusions and Malware, and Vulnerability Assessment.

May I?-Content Security Policy endorsement for browser extensions. Daniel Hausknecht, Jonas Magazinius, and Andrei Sabelfeld.Adrienne Porter Felt, Richard Barnes, April King, Chris Palmer, Chris Bentzel, and Parisa Tabriz.DoubleX: Statically Detecting Vulnerable Data Flows in Browser Extensions at Scale. Aurore Fass, Dolière Francis Somé, Michael Backes, and Ben Stock.CORSICA: Cross-Origin Web Service Identification. Christian Dresen, Fabian Ising, Damian Poddebniak, Tobias Kappert, Thorsten Holz, and Sebastian Schinzel.In USENIX Security Workshop on Cyber Security Experimentation and Test. Malicious Browser Extensions at Scale: Bridging the Observability Gap between Web Site and Browser. Mystique: Uncovering Information Leakage from Browser Extensions. An Evaluation of the Google Chrome Extension Security Architecture. Nicholas Carlini, Adrienne Porter Felt, and David Wagner.A Tale of Two Headers: A Formal Analysis of Inconsistent Click-Jacking Protection on the Web. Stefano Calzavara, Sebastian Roth, Alvise Rabitti, Michael Backes, and Ben Stock.In IEEE Conference on Communications and Network Security. Analyzing the dangers posed by Chrome extensions. Lujo Bauer, Shaoying Cai, Limin Jia, Timothy Passaro, and Yuan Tian.Protecting browsers from extension vulnerabilities. Adam Barth, Adrienne Porter Felt, Prateek Saxena, and Aaron Boodman.VEX: Vetting Browser Extensions for Security Vulnerabilities. Sruthi Bandhakavi, Samuel T King, Parthasarathy Madhusudan, and Marianne Winslett.I spy with my little eye: Analysis and detection of spying browser extensions. Anupama Aggarwal, Bimal Viswanath, Liang Zhang, Saravana Kumar, Ayush Shah, and Ponnurangam Kumaraguru.In Workshop on Measurements, Attacks, and Defenses for the Web (MADWeb) 2021.

First, Do No Harm: Studying the manipulation of security headers in browser extensions. Critical errors in our recent MADweb paper. The impact of our findings is aggravated by the extensions, with millions of installations dropping critical security headers like Content-Security-Policy or X-Frame-Options. In doing so, we detect 1,129 distinct extensions that interfere with security-related request/response headers and discuss the associated security implications. We then use our framework to analyze the three snapshots of the Chrome extension store from Jun 2020, Feb 2021, and Jan 2022. We statically identify extensions with the permission to modify headers and then instrument the dangerous APIs to investigate their runtime behavior with respect to modifying headers in-flight. To this end, we present our automated analysis framework to detect such extensions by leveraging static and dynamic analysis techniques. In this study, we instead focus on extensions that tamper with the security headers between the client-server exchange, thereby undermining the security guarantees that these headers provide to the application. However, prior studies suggest that extensions may degrade the client-side security to execute their operations, such as by altering the DOM, executing untrusted scripts in the applications' context, and performing other security-critical operations for the user. They provide a rich end-user experience by utilizing feature-rich JavaScript APIs, otherwise inaccessible for native applications. Browser extensions enhance the functionality of native Web applications on the client side.

Mozilla browser monster