EmPoWeb: Empowering Web Applications with
Browser Extensions
Dolière Francis Somé
Université Côte d’Azur / Inria, France
doliere.some@inria.fr

Abstract—Browser extensions are third party programs, tightly
integrated to browsers, where they execute with elevated privileges in order to provide users with additional functionalities.
Unlike web applications, extensions are not subject to the Same
Origin Policy (SOP) and therefore can read and write user dataon any web application. They also have access to sensitive user
information including browsing history, bookmarks, credentials(cookies) and list of installed extensions. They have access to apermanent storage in which they can store data as long as they
are installed in the user’s browser. They can trigger the download
of arbitrary files and save them on the user’s device.
For security reasons, browser extensions and web applications
are executed in separate contexts. Nonetheless, in all majorbrowsers, extensions and web applications can interact by exchanging messages. Through these communication channels, a
web application can exploit extension privileged capabilities andthereby access and exfiltrate sensitive user information.
In this work, we analyzed the communication interfaces
exposed to web applications by Chrome, Firefox and Operabrowser extensions. As a result, we identified many extensions
that web applications can exploit to access privileged capabilities.
Through extensions’ APIS, web applications can bypass SOP
and access user data on any other web application, accessuser credentials (cookies), browsing history, bookmarks, list of
installed extensions, extensions storage, and download and savearbitrary files in the user’s device.
Our results demonstrate that the communications between
browser extensions and web applications pose serious security
and privacy threats to browsers, web applications and more
importantly to users. We discuss countermeasures and proposals,
and believe that our study and in particular the tool we used todetect and exploit these threats, can be used as part of extensions
review process by browser vendors to help them identify and fix
the aforementioned problems in extensions.

I. I NTRODUCTION
Browser extensions or addons are third party programs, thatcan extend the functionality of browsers and improve users’
browsing experience. In this work, we focus on the WebExtensions API, a cross-browser extensions system compatible withmajor browsers including including Chrome, Firefox, Operaand Microsoft Edge [1], [2], [3], [4]. Tightly integrated tobrowsers, extensions have access to elevated browser APIs
and features. For instance, they can make HTTP requests to
get data from any web application server, including thosewhere users are logged into, such as their mailing, banking,social network applications, etc. As a comparison, web applications are bound by the Same Origin Policy (SOP) [5]and cannot access other web applications data, unless theyboth implement mechanisms such as Cross-Origin Resource
Sharing (CORS) [6].
Due to their privileged position in browsers, it is well understood that extensions pose serious security and privacy threats
to user data [7], [8], [9], [10], [11], [12], [13]. Therefore, inorder to limit extensions capabilities, a mandatory permission
system requires that extensions explicitly declare the set ofAPIs they effectively need to access. Nonetheless studies haveshown that extensions still require many permissions [14],[15], [16]. Extensions also go through a review process frombrowser vendors [17]. But again studies have unveiled many
malicious extensions circumventing the review process to
exfiltrate sensitive user data [15], [18], [19].
Besides, a benign (non-malicious) extension can be buggy,
allowing adversaries to exploit its vulnerabilities in orderto get access to user sensitive data. One type of adversarythat can exploit such vulnerabilities in extensions is the web
attacker [9], [10], [13]. Indeed for security reasons, extensions and web applications execute in different and isolated
contexts. Nonetheless, extensions have access to the DOM of
webpages. Extensions and webpages can also set up communication channels to exchange data with one another using thepostMessage API [20] for instance. Bandhakavi et al. [9]and Carlini et al. [10] found that a few extensions manipulate
data extracted from webpages without sanitization, leading toprivileged escalations, because such data can be influenced bya web attacker. Calzavara et al. [13] found that message
passing APIs can be abused for privilege escalation, andformally characterized the privileges that be exploited by a
web attacker.
Similarly to those studies, our threat model considers the
web application as the attacker. Specifically, we seek to study
at large scale, the security and privacy implications of message
passing APIs [13] among extensions in the wild, whether there
are extensions that can be exploited by web applications toaccess sensitive user information. For instance, an extension
can set up an interface (register a listener) to receive from web
applications, messages consisting of the URL of a resource(data) hosted by another web application. The extension thenmakes a request to fetch the data (since it can do so with any
web application as it is not subject to the SOP) and returns
the response to the web application that sent the URL. Hence,these communications channels are a way for a deliberately
or accidentally vulnerable extension to indirectly give a webapplication access to browser features and APIs that the web
application is not directly allowed to access.
We built a static analyzer and applied it to the message
passing interfaces exposed by Google Chrome, Firefox andOpera extensions to web applications. When the tool foundthat a privileged extension capability could potentially be
exploited by web applications, the extension was flagged
suspicious. By manually reviewing the code of suspicious
extensions, we found that 197 of them (mostly on Chrome) canbe exploited by web applications (attackers) to access elevatedbrowser features and APIs and sensitive user information. The
extensions we have found have vulnerabilities that can be exploited by web applications to (i) break the privilege separation
between extensions and web applications and execute arbitrarycode in extensions context, (ii) bypass the Same Origin Policy
and access user data on other applications, (iii) read user
cookies and use them to mount session hijacking attacks [21],(iv) access data such as user browsing history, bookmarks,
list of installed extensions that besides violating user privacy
can be used for tracking purposes [22], [23], [24], [25], (v)store and retrieve data from extensions persistent storage fortracking purposes and (vi) trigger the download of malicious
software on the user device which execution can damage userdata.
In summary, this paper shows the security and privacy
threats associated with the interactions between browser extensions and web applications and makes the following contributions:• We built a static analysis tool and analyzed extensions
message passing interfaces at large-scale: 66,401, 9,391
and 2,523 extensions on Chrome, Firefox and Opera
respectively. About 4.97%, 5.14% and 8.48% of Chrome,
Firefox and Opera extensions respectively were flagged
as suspicious.
• We identified 197 extensions that pose various security
and privacy threats to browsers, web applications, andusers. They can be exploited by web applications to
bypass the SOP, read user cookies, browsing history,
bookmarks, list of installed extensions, store and retrieve
data from the extension storage, or download malicious
files and store them on the user device.
We provide online a web page for navigating through thedifferent results of this work, including the tool and videos
demonstrating how we exploited the capabilities of some ofthe extensions.
In the beginning of October 2018, we reported our findings
to the vendors who positively acknowledged the issues. For
instance, Firefox has already removed all the reported extensions, and Opera all but 2. We are still discussing with Operaon how to fix the 2 extensions. With Chrome, we are also
discussing with them on the actions to take. That notwithstanding, we argue that browser vendors need to review extensions
more rigorously, in particular take into consideration the use of
message passing interfaces in extensions. We think that tools
such our static analyzer can help in identifying and fixing thesecurity and privacy threats we have identified in this paper.

We also discuss a few proposals on the current design of themessage passing interfaces so as to mitigate the attacks thatweb applications can mount against extensions.
II. BACKGROUND
A. Browser extensions capabilities
Standard web technologies (HTML, CSS and JavaScript) areused to develop extensions for major web browsers including
Chrome, Opera, Firefox, and Microsoft Edge. Interestingly,
their specific extensions APIs, [1], [3], [2], [4] are compatible
with each other to some extent, making it easy to migrate
extensions written for a specific browser to other browsers withjust a few changes. This work focuses on these extensions,referred to as WebExtensions.
Extensions security considerations Extensions are third
party software, that users install to alter their browsers behavior and improve their browsing experience. Tightly integrated
to browsers, extensions have access to privileged browser
features, making them interesting targets for attackers. Hence,
to limit the harm that attackers could cause if they takecontrol of an extension, the APIs that extensions effectively
have access to are only those for which they have explicitly
requested the related permission in their manifest.json
file. Listing 1 shows an example of manifest file and thepermissions (features and APIs) the extension will be
granted at runtime.
{"permissions": ["<all_urls>","storage","management","cookies""history","bookmarks","downloads",]}

Listing 1: Permissions declaration in a manifest file
These are only a subset of all the capabilities provided bybrowsers to extensions. When installed, this extension will be
granted full access (read/write) to data on any web application,
thanks to its host permission <all_urls>. This implies
that if the user is logged into a web application (such as
mailing, banking, social networks), the extension also hasaccess to the user’s private data on that application. The
rest of the permissions read straightforwardly. The storage
permission allows the extension to store and retrieve datain the browser as long as it is installed. The permissions
management, cookies, history, and bookmarks givethe extension access to the list of installed extensions, web
applications cookies, user browsing history and bookmarks
respectively. With the downloads permission, the extension
can download and save arbitrary files in the user device.
At runtime, those APIs (and any extension-specific API ingeneral) are all accessible via the chrome object in Chrome
and Opera browsers, and via browser object in Firefox andMicrosoft Edge. To ease the readability of this work, we often
omit the chrome and browser from extensions APIs names.
Architecture

Fig. 1: Browser extensions architecture - Communications
with web applications
Extensions can be divided in three main parts, as shownin Figure 1. The background page is the main part of theextension. It has full access to all the capabilities of theextension. Users interact with the extension through UI pages(i.e. UI elements, options and setting pages), in order to enable
or disable it, or customize its behavior. UI pages also haveaccess to the full capabilities of the extension. Content scripts
are injected by extensions to run along web applications.
Even though they are not granted access to all the extension
capabilities, they can directly use the host and storage
permissions to access user data on any web application or tostore and retrieve data from the extension storage. Content
scripts can also manipulate the DOM of webpages [26] andinject content in them. On Chrome and Opera, each extension
is assigned a permanent unique identifier, which is the samefor all users of the extension. Firefox however generates arandom identifier for the extension, per user browser [27].
B. Interactions
Background and UI pages have direct access to each other’s
execution contexts [28], but content scripts execute in a
separate context. Web applications run in yet other separate
execution contexts. Nonetheless, content scripts have directaccess to web applications localStorage, DOM, and execution
context, where they can inject and execute arbitrary scripts.
Even though content scripts, background pages and web
applications run in separate execution contexts, they canestablish communication channels to exchange messages with
one another [29], [30] as shown in Figure 1. We describe
below the APIs for sending and receiving (listening for)messages between the content scripts, background pages andweb applications.
Content scripts and background pages There are two
types of communication channels: one-time and long-lived
channels. One-time channels are opened to send a message andare closed after the response is received. Long-lived channels,
connections or ports, are maintained open to exchange multiple
messages. A port can have a name in order to distinguish itfrom other long-lived channels.
For one-time messages, content scripts use theruntime.sendMessage API to send messages tobackground pages. Similarly, background pages employ thetabs.sendMessage API to send messages to content
scripts. For receiving messages, both components can invoke
the runtime.onMessage.addListener API.
Similarly, runtime.onConnect.addListener andruntime.connect are used to establish long-term communications between background pages and content scripts.
Web applications and content scripts Exchanges between web applications and content scripts are achieved with
the Cross-Origin Communications API [20]: postMessage
is used for sending messages, and onmessage or
addEventListener to receive messages. Below is a listing
which shows how messages are sent and received between web
applications and content scripts.
// Send and receive
postMessage("Hello Extension", "*");
addEventListener("message", function(event){
Received_response = event.data;});// Receive and Reply
addEventListener("message", function(event){
Received_message = event.data;
postMessage("Hello Web Application", "*")});In this example, the web application sends the message
Hello Extension to the content script, which receives andwrites it in the variable Received_message. Then it replies
with Hello Web application, which the web application receives and saves in the variable Received_response.
Web applications and background pages On Chrome
and Opera, web applications can also directly communicate
with extensions background pages. To do so, extensions
have to declare in their manifest.json file, using theexternally_connectable key, the list of web applications, where communication with the background page isallowed. For security reasons, one cannot use wildcard (forinstance *) to allow communications between the backgroundpages and all web applications. Additionally, communications
can only be initiated by web applications.
The runtime.sendMessage and runtime.connect
APIs are exposed to web applications in Chrome and Opera,
and can be used to send one-time messages or establish longterm connections with background pages. Conversely, theAPIs runtime.onMessageExternal.addListenerandruntime.onConnectExternal.addListenercan be used in the background page, to receive and reply
to messages sent by web applications. Below is an exampleof how to send a message from a web application to thebackground page of an extension which unique identifier isExtensionID.
// Send and Receive
chrome.runtime.sendMessage(ExtensionID, "Hello
Extension", function(response){
Received_response = response;});// Recieve and Reply
chrome.runtime.onMessageExternal.addListener(
function(message, sender, sendResponse){
Received_message = message;

sendResponse("Hello Web application");})to successfully exploit their capabilities. Figure 2 shows theanalysis process.

The application sends Hello Extension to the background page
which replies with Hello Web application.
C. Threat models
An attacker is a script that is present in a web application
currently running in the user browser. The script either belongs
to the web application or to a third party. The goal of theattacker is to interact with installed extensions, in order toaccess user sensitive information. It relies on extensions whose
privileged capabilities can be exploited via an exchange ofmessages with scripts in the web application. We consider thefollowing security and privacy threats posed by extensions.
1) Execute code: these are extensions that can be exploitedby the attacker to execute arbitrary codes in the extension context. Executing code in the background page
gives the attacker access to all the capabilities of theextension. In content scripts, the attacker can bypass
SOP by making cross-origin AJAX requests, and use
the extension permanent storage for tracking purposes.
2) Bypass SOP: in this case, an attacker can exploit thecapability of the extension to make cross-origin requests
without being restricted by the Same Origin Policy.
3) Read Cookies: the attacker can read the user cookies
and use them to mount session hijacking attacks, accessuser data and take actions on her behalf.
4) Trigger Downloads: the attacker exploits extensions
to trigger the download of arbitrary malicious files(software) and saves them on the user’s device without
requiring any action from the user. If the user inadvertently runs such software, the attacker takes control ofher device and performs malicious actions.
5) Read browsing history, bookmarks and list of installed extensions: these information reveal the userinterests and habits and can be used by the attacker for
tracking purposes, or to serve targeted and personalized
advertisement.
6) Store data: the attacker can store and retrieve information in the extension storage. This can be used for tracking purposes, even though users clear web applications
storages.
For the sake of simplicity, we often refer to the attacker as the
web application in which it runs.
III. M ETHODOLOGY
We built a static analyzer that detects suspicious communications enabled by extensions with web applications. To
identify extensions that are potentially concerned with thesecurity and privacy threats identified in the previous section,
we focus on 78,315 extensions from Chrome, Firefox andOpera browsers. Then we manually reviewed the code ofthe extensions to precisely validate the results of the static
analyzer, and more importantly to construct the signaturesof the messages that have to be exchanged with extensions

Fig. 2: Methodology - static and manual analysis

A. Static analysis
The goal of the static analyzer is to report only extensions
that potentially pose a security and privacy threat, in orderto reduce false positives as much as possible, and reducethe burden of the manual analysis. It has been fully written in JavaScript, using various Node.js packages. We used
Esprima [31] and Recast [32], for parsing and manipulating
JavaScript abstract syntax trees (AST), and Jsdom [33] forparsing HTML.
Unpack extensions and gather scripts We crawled extensions using SlimerJS Browser Automation tool [34]. In
the extension manifest.json file, background pages areeither declared by a set of scripts files, or an HTML file,which further includes the scripts of the background page.
UI pages are built as HTML pages, and also indicated inmanifest.json file. The Jsdom HTML parser served
here to extract scripts embedded in background as well as
UI pages. Static content scripts are directly declared in the
manifest.json file. Background and UI pages can further
dynamically inject content scripts in web applications, bycalling the tabs.executeScript API. Those were also
extracted by analyzing the AST of background and UI pages
scripts, and analyzed as other content scripts.
Parse scripts and build AST Scripts were parsed with Esprima, resulting in an AST [35], which contains all JavaScript
constructs used in content scripts, background and UI pages
scripts. Almost everything in JavaScript is an object [36].
To ease manipulation of the AST, the following additional
actions were taken to build three indexed tables of assignments
to variables and object properties (assignments), function
definitions/expressions and object methods (functions),
and finally functions and object methods invocations (calls).
Basically, those are key/value pairs, in which the keys inthe tables corresponded to the names of variables, object
properties and functions. Each entry was then associatedwith a list of all possible values it could resolve to. For
assignments, the values were all expressions assigned to avariable or object. For function definitions and object methods,

the values were the parameters and body of the function.
Finally, for function calls, the values associated to their namesin the indexed table were their invocation arguments. The
static analyzer successfully handled functions defined using
the bind method, and functions invoked using the call orapply methods.
Event handlers of page messages APIs For each message listener (See Section II) in content scripts, backgroundand UI pages, we first looked up the indexed table offunction invocations (calls) to search whether the extension registered listeners for messages from the web applications (a call to addEventListener API for instance incontent scripts). In browser contexts, all JavaScript objects
are properties of a global object named window. Different aliases, this, self, global, are sometimes used
to refer to the window object [37], [38]. JavaScript object properties can be accessed using the dot and the arrayor bracket notations [39]. For the sake of simplicity, we
considered the dot notation and the bracket notation when
the property name was a literal (a string). Considering the
global object names (window, top, self, this), andJavaScript dot and bracket property accesses, we generated
the different ways an API can be invoked. For instance,
addEventListener can be called in 9 different ways
addEventListener, window.addEventListener,
window["addEventListener"] and others. In general,
we consider that an object could be accessed in 9 different
ways, its properties in 18 different ways, the properties of
its properties in 36 ways and so forth. When we foundan invocation to communications APIs in content scripts,
background and UI pages, we extracted their arguments andresolved them as follows.
For addEventListener, the first argument should be
the literal message, and the second argument a function.
Otherwise, we use the indexed table of assignments andfunctions to resolve them to the literal message and afunction respectively. Resolving an argument simply consist
in checking whether the indexed table has an entry which
key matches the argument name, and further checking whether
any of its associated values resolve to the type and value we
expect the argument to have. For addEventListener, we
expect the first argument to be a Literal and have the value
message. Its second argument is expected to be a function.
We follow the same process to extract all message handlers(listeners) in content scripts, background and UI pages.
Sensitive APIs Calls The handlers (functions) of web
applications messages in extensions are parsed to extract all
their constructs. If the handlers further call other functions,those functions are looked up using the indexed table, andtheir bodies parsed to also extract their constructs. Finally,
the constructs are analyzed to decide whether the extension
potentially poses any of the security and privacy threats
considered in this work.
•

An extension is flagged as potentially executing arbitrary code sent from web applications if it invokes

functions like eval (in any part of the extension) or
tabs.executeScript (in background and UI pages).
• An extension is flagged as potentially allowing web applications to bypass SOP, if its constructs include APIs thatcan be used to make AJAX calls. This includes the creation of new XMLHttpRequest objects, calls to fetch
API, or any AJAX specific API provided by popular
third party libraries such jQuery and AngularJS ($.get,$.ajax, $.post, $http.get, $http.post).
• If the constructs include calls to storage API such as
storage.local.set, storage.local.get,storage.sync.set, storage.sync.get, thenthe extension is flagged as potentially storing/retrieving
data for web applications.
• An extension is considered as potentially leaking user
cookies, history, bookmarks, and list of extensions
to web applications if either of the following
invocations were found in their message handlers
constructs: cookies.getAll, history.search,history.getVisits, bookmarks.getTree,
management.getAll, and related APIs.
• Finally, an extension is considered as probably allowing
web applications to download and save files in the user
computer (device) if their messages event handlers constructs include invocation to downloads.download.
It is worth mentioning the case of content scripts forwarding
messages to background pages. When this is the case, theconstructs of content scripts messages handlers in the background pages are also analyzed, looking for calls to any API
which potentially poses security and privacy threats. In fact,content scripts only have access to the host and storage
capabilities. When they need access to more capabilities, they
can send messages to the background pages which may thengive them access to the related capability. Content scripts canforward messages they receive from web applications, to thebackground page. The latter handles the message and responds
to the content scripts which in turn respond to the application.
This is particularly true in Firefox which does not allow directcommunications between web applications and backgroundpages. Nonetheless, we have observed many content scripts
forwarding messages to background pages, even to access
APIs they can directly use from their own context.
B. Manual Analysis
Recall that for each suspicious extension, the tool reports
precisely (i) the component(s) (content scripts, background or
UI pages) and the file or set of files to analyse, (iii) the nameof the message passing interfaces registered (iv) the handlersof the message passing interfaces and other functions that are
called from those handlers (v) and finally, the sensitive APIs
that are triggered in the handler and its called functions. So
the goal of the manual analysis was to confirm the suspicionof the static analyzer, build and test the precise signaturesof messages that had to be sent by web applications to
exploit extensions capabilities. Following is how we typicallymanually review an extension.

Unpack in Browser First, we download and unpack theextension code directly in a browser, using the CRX Extension
Viewer [40]1 . We locate the files to be analyzed, according to
the concerned component(s). In the particular case of content
scripts, the tool reports the precise index in the content scripts
array containing the file or set of files that has to be analyzed 2 .
Identify Messages This step is concerned with building the
payloads or signature of messages that can be sent to theextension to exploit is capabilities. In each file, we search
for the message passing interfaces, their handlers and thefunctions they invoke. In those handlers and functions, welook for the sensitive APIs that are triggered and more
importantly, the parts of the received messages that trigger
calls to the extensions sensitive APIs. To build the payloads,
we carefully inspect how objects received as parameters in
the message passing interfaces handlers (and related functions)
are manipulated, which properties of the objects are accessed,
the names of the properties, and their values. This gives us
the precise signature of the messages. Two situations arise
here. Either we found that the signature of the messages arepredefined by the extension, in which case they cannot be
influenced by the attacker (See Section V-H for more details),
and we stop the analysis and consider the extension as a false
positive. Otherwise, we continue the analysis by installing andinteracting with the extension by sending messages according
to the signature that we have found.
Install and Test – Download and Patch The final step
consists in mounting the exploits against the vulnerable extension with the payloads built in the previous step. Thoseinteractions are done from the Browser console [41], after wenavigate to the websites in which the extension injects its files.
Sometimes, those websites require users to be logged in. We
would create accounts and navigate to them. In rare cases, we
could not create accounts or the websites were not responding.
So we download the extension, and modify its permissions inorder to make it inject files in websites that are accessible(i.e. http://localhost/), from were we mount the attack. During
the tests, we use the browser debugger, set breakpoints in theextension codes in order to track the propagation of messages
and calls in the extension code.
Time taken to manually analyze extensions It is rather
difficult to precisely evaluate how much time it takes tomanually analyze an extension. Indeed, this work went through3 phases. We did a first crawl of extensions in the middle ofNovember 2017 and run our static analyzer to test it. It tookaround 2 months and half ( till the beginning of February 2018)
to come with a mature analyzer. But during that phase, we hadalready discovered almost 87% of the extensions reported inthis paper. Then, from the beginning of February 2018 weanalyzed all the extensions again in around 4 weeks. Finally,in mid of May 2018, we did a new crawl and analysis, and it

took around 10 days to vet the extensions. Again, for most of
the extensions, we had already tested them, built the signaturesof the messages, so analyzing them again consisted only inchecking that they were still exploitable.
So overall, what we observed is that during the phase
we implemented and tested the static analyzer, manuallyreviewing the code of a suspicious extension was long, because
the process was rather imprecise and not straightforward. Thenthroughout that period of tests, we had acquired a lot ofexpertise in the review process, which made it faster in theend. For instance, we have started to recognize similar patterns
and codes in extensions (many extensions reuse similar code)and therefore we knew when they had to be skipped or not an
extension. Currently, we think that for an expert, 15 mn would
be a sufficient average time to correctly review an extension for
the threats that we have reported. In practice, some extensions
will take longer to analyse while others will be analyzed in acouple of minutes.
C. Limitations and Challenges
First note that we considered only scripts that are partof the extension packages. For instance, background andUI pages may reference external scripts. Those scripts were
not considered in our analysis. Nonetheless, we think that
extensions bundles are more likely to contain most of the APIs
that we consider in this work, as extensions developers arerecommended to avoid referencing remote scripts in extensions
codes.
Our static analysis tool suffers from many limitations. The
first one is the fact that we did not consider scopes [38], whichlead to unnecessary functions being analyzed. However, this is
not a problem ultimately because all the results were further
manually reviewed to remove false positives. It also suffersfrom some false negatives, mainly because of the flexibilityof JavaScript that make it challenging to exhaustively address
all the ways message listeners can be invoked in extensions.
Manually analyzing complex, large and sometimes minified
and obfuscated JavaScript programs making use of callbacks
everywhere is not trivial for a single person. But we have taken
all the time that was necessary to correctly perform the study.
Finally, for a very few extensions, despite all our efforts atthe static and manual analysis levels, we could not draw any
conclusion about the potential threats they may pose.
IV. T OOL FOR ANALYZING COMMUNICATIONS API S
This section demonstrates a case study of the tool. We havereleased online a web version of the tool. It can be used toanalyzed extensions directly in a browser.
Result of the static analyzer Listing 2 shows the result
produced by the tool when applied to the eRail.in Chrome
extension [42].
{1 CRX Extension Viewer [40] is an handy extension that can download andnicely display in the browser the content of extensions, allowing to navigate
their files very conveniently
2 Indeed, content scripts are declared as an array of a set of files, so thetool reports the index of the files to analyse"com_via_cs": {"to_back": {"back": {"ajax": {"$.get": "","$.post": "","$.ajax": "","XMLHttpRequest": ""},"cookies": {"chrome.cookies.getAll": "","chrome.cookies.remove": "","cookies": ""
}
}
}
}
}

Listing 2: Result of analyzing the eRail.in extension
com_via_cs implies that webpages can communicate
with the extension via the content scripts, by using thepostMessage API. This extension has only 1 content
script. When there are multiple content scripts, the tool
analyzes each of them independently and produces resultscorresponding to each of them.
• to_back indicates that the messages sent by webpages
to the content script are forwarded to the extension
background page.
• The
tool found that two sensitive APIs arereached in the background page: AJAX requests
with calls to the jQuery AJAX APIs ($.get,$.post, $.ajax) and access to cookies withinvocation to the chrome.cookies.getAll andchrome.cookies.remove APIs.
The main goal of the tool is to raise awareness about
the fact that an attacker may potentially get access to theextension’s privileged APIs. One can then further review thecode to validate or refute the results of the tool. For instance,
after manually vetting the code of the eRail.in extension, we
effectively confirm that any webpage can access all user cookies and make AJAX request to any domain. See Section VI
for more details about examples of messages to be sent toextensions to benefit from their privileged capabilities.
Releasing the tool In addition to the full static analyzer
used in this work, we have also prepared an online version foranalyzing the message passing APIs of extensions. The only
difference with the version used in this work is that it does nothandle dynamically injected content scripts. This was done forsimplicity reasons. That notwithstanding, in order to analyze
dynamic content scripts, one can simply declare them in theextension manifest as static content scripts. Both versions of
the tool will be publicly released.
There is room for further improving the tool. For instance,
lessons can be learnt from the state-of-the-art on JavaScript
static analysis tools in order to improve the extraction of
messages passing listeners and tracking the escalation ofextensions sensitive APIs. The set of threats considered inthis work can also be extended further with state-of-the-art
extensions threats in the literature.
•

V. E MPIRICAL S TUDY
We downloaded Chrome [43], Opera [44], and Firefox [45]extensions by the end of November 2017. The extensions were

statically analyzed in the beginning of February 2018 — on acluster of 200 nodes mainly because of storage limitations on
our own devices. This was preceded by a long period of tests
during which we improved the static analyzer, and fixed thelist of security and privacy threats. In the middle of May 2018,
we did another crawl and analysis. The results presented here
are for this second dataset.
In this section, we first give an overview of the results, thenwe discuss in more details each threat and the report extensions
where it was found.
A. Overview
Table I presents the number of extensions we collected andanalyzed. Chrome provides the largest share of extensions,followed by Firefox and Opera. Recall that for Firefox, weare considering only extensions built using the new WebExtensions API [2], and not those using the XPCOM/XUL API [46].
The static analysis tool reported 3,996 suspicious extensions
that we manually vetted. The results of the manual analysis
are also shown in Table I. As with the share of extensions,
Chrome had the largest share of extensions with threats. In a
total of 197 extensions, only 16 were found on Firefox, 10
on Opera, and the 171 others are Chrome extensions. Notethat some single extensions pose more than one threat at atime. All the 197 extensions reported here effectively posed atleast one or more of the security and privacy threats describedin Section II. During the manual analysis, we also identified
the messages to be sent in order to exploit their capabilities.
The full list of the extensions and the threats that they pose are
given in Table IX in the Appendix, because of page limitations.
TABLE I: Data overview
Extensions analyzed
Suspicious extensions
Execute Code
Bypass SOP
Read Cookies
Read History
Read Bookmarks
Get Extensions Installed
Store/Retrieve Data
Trigger Downloads
Total of unique extensions

Chrome66,401
3,303
15
48
8
40
37
33
85
29
171

Firefox
9,391
483
2
9
1
2
5
16

Opera
2,523
210
2
6
3
2
10

Total
78,315
3,996
19
63
8
40
38
33
90
36
197

Extensions installs and categories Figure 3 presents the
distribution of users impacted, or the number of installs per
extension at the time of writing this paper. Around 55% of
the extensions have less than 1000 users, while the remainder
45% have thousands of installs, showing that those threats
are present in rather popular extensions, hence affecting manyusers. About 27% of extensions have less than 100 users andanother 27% have between 100 and 1000 users. We see this as
an opportunity for a tool such as ours to help improve extensions security, as it can serve to detect potentially malicious
extensions while they are not yet very popular among users,
thereby limiting their impact on users.
Table II further presents the category of these extensions.
Note that the categorization of extensions is not done the same

way by Chrome, Firefox and Opera browsers. Some categories
exist only on specific browser, and not on others. Moreover, wefound similar (or the exact same) extensions being differently
classified depending on the browser. We tried to merge thedifferent categories whenever possible.
As one can observe, Productivity is the most popular
category among the reported extensions. It is also the mostpopular category among all Chrome and Opera extensions
we have downloaded, and also the most popular category invarious datasets in recent studies [24], [23], [19]. This category
does not exist on Firefox.
We were surprised by the results that only 15 extensions(7.61%) are classified as Developer Tools. Considering
the severity of the threats, we were expecting that most ofthem would be extensions provided for developers to perform
some controlled experiments. Since our results represent only
a lower bound of the number of extensions potentially posing
these risks, it would not be surprising that even more extensions also exhibit similar threats.
0-100

0

10

101-1000

20

30

40

1001-10000

50

60

10001-100000

70

80

100001+

90

100

%

Fig. 3: Distribution of the number of users per extension
TABLE II: Category of extensions
Category
Productivity
Social & Communication
Fun
Accessibility
Developer Tools
Search Tools
Shopping
Blogging
Privacy & Security
Other
Appearance
Total# Extensions
81
48
19
17
15
6
4
2
2
2
1
197

Extensions privilege only some web applications About
55 extensions (45, 7 and 3 on Chrome, Firefox and Opera
respectively) communicate with any web applications to givethem access to extensions privileged APIs. Interestingly, on
Chrome, 7 of them allow to execute arbitrary code in theextension context, 15 of them are concerned with SOP bypass,
26 for storing data, 2 can be exploited by any web application
to read all user cookies and 5 to read the cookies of the current
web application.
The vast remainder of extensions (72.08%) can be exploited
only by specific web apps to benefit from their privileged
capabilities. For instance, reading user browsing history, bookmarks, and list of installed extensions, is enabled by extensions
only to specific applications such as fliptab.io, atavi.com,

mail.google.com. In particular, downloads are allowed bymany extensions (on Chrome and Opera) mostly from vk.com.
The fact that most extensions allow communications with
only some specific apps can also be explained by the fact thatmost of those we found allow interactions between web apps
and the background pages directly. Let us recall that it is only
possible to allow communications between background pages
and specific web apps (and not all web apps).
Extensions allow to connect to arbitrary web applications If many extensions tend to privilege specific web
applications as shown previously, the exact opposite is observed regarding the hosts extensions allow web applications
to connect to, in order to access user data. For example, 37
out of the 48 extensions that can be used to bypass SOP on
Chrome, give access to the user data on any other application.
On Firefox, it is 6 out of the 9 extensions which allow accessto any web application data.
These two observations (extensions mostly give access totheir privileged APIs only to some web applications, and allow
them to access any other web application data in the caseof SOP bypass) suggest that the access they give to theircapabilities is rather deliberate. Moreover, for the majority ofextensions, the messages to send to exploit the different APIs
in extensions are so trivial that they could have only been
deliberate (See Section VI).
Most privileged web applications As already mentioned,
most extensions allow specific apps to benefit from their privileged APIs. This is the case for instance of fliptab.io where
scripts can communicate with 31 very similar HD wallpaper
extensions on Chrome, that has hundreds to thousands of users.
The domain vk.com can interact with 19 extensions (17 on
Chrome and 2 on Opera), mostly to download files on the user
device. The domain atavi.com can get access to user’s history,
most visited websites (topsites) and bookmarks thanks to 6
extensions.
Extensions which pose more than one threat All theextensions reported here pose at least 1 of the security andprivacy threats considered in this work. Nonetheless, someextensions pose several threats.
The eRail.in [42] extension on Chrome gives access to alluser cookies and allows full SOP bypass from any web application. Moreover, it has more than 400k users. Interestingly, aversion of the extension exists on Firefox, but it leaks cookies
and data of a limited set of web applications (all related to theextension owner’s domain) to the the extension’s provider own
domains. Five extensions provided by Fabasoft (See Table VI
in the Appendix) leak the current tab cookies. As such, they
allow attackers to even access HTTPOnly cookies, and use
them to mount session hijacking attacks.
Ringostat dialer [47] is the only extension that executes
arbitrary code sent from app.ringostat.com directly in its
background page. All other extensions execute the arbitraryattacker code in the context of the content scripts. Recall
that the background page has access to all the capabilities anextension declares. Interestingly, it has the host, storage,cookies, and tabs permissions, meaning that any scriptpresent on app.ringostat.com can access user data on any otherdomain, access the extension storage, cookies, open new tabs,
inject code directly in any tab, etc.
StartHQ [48] also allows to bypass SOP from starthq.
com, and leaks user browsing history. Similarly, SalesforceIQ
CRM [49] allows to bypass SOP and leaks installed extensions
to mail.google.com and salesforceiq.com.
Finally, user browsing history, bookmarks and installed extensions can be read by an attacker in atavi.com and *.fliptab.io
thanks to 6 and 31 extensions respectively (See the full list in
the Appendix). The latter also let fliptab.io stores and retrieves
data in the extension storage.
Cross-browser extensions It is worth mentioning that mostof the extensions we found on Opera and Firefox were alsopresent on Chrome. While the compatibility of extensions
APIs on major browsers [2], [1], [3], [4] let developers reachmore users, attackers also widen their attack surface because
they can impact more users thanks a single cross-browser
extension. For instance, we have noticed that megatest2016,
an extension provider, had 2 extensions on Chrome, anda very similar one on Opera. At the time of writing thispaper, Chrome removed the 2 extensions (they were allowing
ok.ru and other applications to bypass SOP, but we do notknow if their removal were due to the SOP bypass) while
on Opera, it is still available as MegaTest - [50]. The 2
Photo Zoom for Facebook and Facebook Photo Zoom Firefox
add-ons have similar versions on Chrome, but these do notallow SOP bypass. Similarly, the ModernDeck extension ispresent both on Opera [51] and Chrome [52]). On Opera, it
allows to store/retrieve data, while on Chrome it does not. This
represent yet another problem of cross-browser extensions.
While users of the same extension suffer from security andprivacy threats on one browser, on the other browser where theextension is removed or fixed, users do not. Browser vendors,
and more importantly users would gain from security andprivacy perspectives, if browser vendors share their reviewsof extensions with one another, in order to help take similaractions like removing extensions, or updating them to remove
threats they pose.
B. Execute Code
Extensions execute in browsers with elevated privileges.
From an attacker’s perspective, being able to execute arbitrarycode in an extension context also gives the attacker access tothe extension capabilities. We found 15 extensions on Chrome,
2 on Firefox and 2 on Opera that can be exploited by web apps
to execute code in their privileged context. Only one extension
on Chrome Ringostat dialer [47] executes in its background
page, code that it receives from app.ringostat.com. Then it
gives access to user data on any application, user cookies,
allows code injection in in any tab the user opens, the useof the extension storage, etc. All other extensions executethe attacker’s code in the contexts of the content scripts.
Even though content scripts have limited access to extensions
capabilities, they are not subject to SOP, can store/retrieve

data, and more importantly, they have access to the full DOM
on the web applications pages in which they are injected.
The extension iwassa, present on Opera [53] andChrome [54] allows any app to open any URL in a newtab, and execute any code (content script) in it. If the codein the context of the content script can already access any
application data, one can further inject specific content in
the DOM of the new tabs opened, to exfiltrate for instanceany token/secret present in the application DOM. In fact, in
addition to cookies, many sensitive applications use tokens tofurther perform additional checks about the origins of requests
before letting users perform sensitive actions on their data.
Another interesting example is that of the LinkClicker
extension also present on Opera [55] and Chrome [56]. It
allows any application to send a code which will be further
injected in any new tab the user opens during the current
browsing session. One can use it to track the user while she isbrowsing, gather any credentials that she is providing to log
into any application, and exfiltrate those to the attacker.
In many of these cases, the problem is due to the fact thatthe extension does not correctly sanitize the codes received
from web applications, allowing attackers to execute arbitrarycodes. A good example is that of the GureTV: To watch
television extension on Firefox [57]. It did well to sanitize
content sent from web applications, but not content sent from
iframes embedded in the applications. Hence, one can create
an iframe, and send an arbitrary code which will be executedin the context of the content scripts.
Many of the other extensions work similarly, and allow(at least) to access arbitrary user data on any application,
and/or store and retrieve data (when they have the appropriate
permissions).
C. Bypass SOPExtensions are not subject to the SOP, and therefore haveaccess to user data on any web application for which they havedeclared the host permission. Through message exchanges
with extensions, 48, 9 and 6 of extensions on Chrome, Firefox
and Opera respectively, allow web applications to bypass
SOP by accessing user data on any other web application.
As for other threats, the trend is rather to allow only some
web applications to bypass SOP, even though 15 of such
Chrome extensions allow any application to access any otherapplication data. Hence, the majority of arbitrary SOP bypass
can be exploited by specific web applications, including: ok.ru,
mail.google.com, logincat.com, etc. Interestingly, when SOP
bypass is possible, in most of the cases the data of all domains
can be accessed. On Chrome for instance, it is 37 out of the
48 extensions that allow access to any application data. Even
when the SOP bypass is partial, it is enabled to rather sensitive
domains. For instance, 5 extensions out of 11 allow SOP
bypass to users’ Google accounts: salesmate.io, appspot.com
and aliexpress.com can access users Gmail account. One
extension [58] allows access to the linkedin.com data of morethan 400k users from Gmail, and blog.renren.com can accessgithub.com [59].

D. Cookies

E. Downloads

We found 8 Chrome extensions that can be exploited by
web applications to read user cookies: 2 of them allow any
web application to read all user cookies [42], [60], 1 only
allow app.ringostat.com [47] to read all user cookies,
and the other 5 of them allow an attacker script to read thecookies of the tab in which it executes. The number of users
affected is very important (more than 415k for eRail.in [42],9.6k for Telerik Test Studio Chrome Playback 2014.1 [60]and 78 for Ringostat dialer [47]. Cookies can be used tohijack users browsing sessions, access their data and takeactions on their behalf. It is worth mentioning that the threeextensions that can be exploited to read all user cookies, haveprobably been poorly programmed. It is more likely that theability to read cookies was meant to be used from specificweb applications, but unfortunately the extensions were poorly
programmed, allowing other web applications to also get
access to user cookies. In particular, the Ringostat dialer [47]extension did not expose any means to get user cookies. But
it allows to execute any code sent from app.ringostat.com inthe extension background page context (using eval function),giving the application access to all the capabilities of theextension. Among those, the cookies, storage and arbitrary
host permissions, and the ability to open tabs, inject andexecute arbitrary code in them, etc.
We found that the web application https://erail.in/ is effectively reading all user cookies when the eRail.in [42]Chrome extension is installed. This means that the extension
is intentionally given access to user cookies to https://erail.in.
However, it is not clear whether the cookies of interest were
only those of https://erail.in or any cookie or if only cookies
of https://erail.in/ were meant to be leaked. Unfortunately,
any web app can access all user cookies stored by any web
application, and use them to hijack user sessions. Interestingly,
the extension has a version on Firefox, where the cookies
which are leaked are only those of domains related to erail.in
and are leaked only to erail.in and eair.in.
The case of the extension Telerik Test Studio Chrome
Playback 2014.1 [60] is particularly interesting, as one has
to setup complex interactions, involving the extension content
scripts and background page, as well as the application and its
server. In particular, the interactions are triggered from the web
application, but the cookies are sent to the server of the application instead of being returned directly to the application.
Following the same mechanism, one can clear cookies, deleteuser browsing history, etc. A similar extension is also available
on Firefox progress-test-studio-extension. Unfortunately, we
could not analyze it as it was not downloading.
Finally, 5 Fabasoft extensions (See more details in Table VI
in the Appendix) allow the attacker to read the current tab
cookies of any web application. Even though a web application
protects its cookies with the HTTPOnly flag [61], an attacker
script running in the web application bypasses this protection
by obtaining the cookies via the extension. It can further use
them to mount session hijacking attacks against the user.

Exploiting extensions to trigger the download of arbitrary
files is enabled mainly from specific applications including
vk.com (See Table IV in Appendix) and ok.ru. Only 2 extensions on Chrome and 3 on Firefox allow downloads fromarbitrary web apps. The main purpose of the related extensions
were to allow the download of music and videos. Sometimes,
they would even suffix the downloaded file name by .mp3
or .mp4. Nonetheless, we have been able to exploit these
extensions in order to trigger the download of arbitrary files
and save them in the user’s device. An attacker can also do
so to download malicious software, which when inadvertently
executed by the user, may allow the attacker to take controlof their computer and perform malicious actions.
It is worth mentioning that none of these extensions required
user action to trigger the downloads. One of them, multiDownloader [62] even overwrites a file if it is already present on
the user’s device.
It is also worth mentioning the case of the Chrome repl.it
download extension [63]. It is a helper extension for the https://repl.it application used for creating and running programsin different languages online. The extension allows to savethe code being created. Even though the extension prompts
the user to confirm the file name (default is program.), thecontent of the file can be fully arbitrary. As such, an attacker
can trick the user in saving the code being edited, while acompletely different content is saved.
F. History, Bookmarks, and List of Installed Extensions
Two providers distinguish themselves with regards to extensions that can be exploited to get access to user browsing history, bookmarks and list of extensions. On Chrome,
fliptab.io [64] provides 31 very similar HD wallpapers
extensions (See the full list in Appendix), and allows fliptab.io
to get all browsing history, bookmarks and the list of user
installed extensions. Each of these extensions has between ahundred and 25k users.
Furthermore, six extensions provided by atavi.com also provide the same privileges to pages at atavi.com and atavi.test.
One of them, Atavi - bookmark manager [65] has more than
96k users.
Additionally, Browser History [66] leaks user browsing
history to www.americaninternetmatrix.com/history. Finally,
StartHQ [48] leaks browsing history to https://starthq.com.
Other extensions that give access to the list of extensions
include Boomerang for Gmail [67] (with more than 1.5 million
users) to mail.google.com and SalesforceIQ CRM [49], tomail.google.com and salesforceiq.com.
G. Store/Retrieve Data
About 85 extensions can be exploited by various web
applications to store and retrieve data. On Chrome, 26 ofthese extensions give any application access to their storage.
Others give specific apps access to their storage. For instance,
fliptab.io can store data in the user’s browser thanks to
its 31 extensions. The domain netflix.com is also able tostore data thanks to 3 extensions, and mail.google.com
to do so thanks to 2 extensions. The extensions ISOGG YTree AddOn [68] and PhyloTreeMT AddOn [69] are fromthe same provider, even though the web applications they
allow to persist data are respectively isogg.org andphylotree.org.
Recall that extensions storage is persistent and not affectedby the clearing of browsing data (web application cookies,
storages, ...). As such, they represent a resilient storage which
can be used to bypass user privacy preferences and uniquely
identify them even though they have cleared their cookies.
Interestingly, some extensions propose to sync data they store
on all the devices the user is logged into. For instance, if a user
logs into multiple devices with the same extension installed,then syncing storages lets an application tracks her accross all
her devices.
H. Other Threats
For SOP bypass, we have reported here the cases where
web applications can access arbitrary data on other web
applications. Nonetheless, we found many extensions allowing
to access some predefined data of other web applications.
This also represents a SOP bypass (since web applications
cannot access such data with their normal privileges). Finally,
we found some Opera and Chrome extensions (like the 31
HD wallpaper extensions by fliptab.io), and some not reportedhere) which allow web applications to clear user browsing data
including cookies (or even set/get cookies of some specificdomains), history, bookmarks, cache, stored passwords, or
enable/disable/uninstall extensions. We do not include suchcases in this paper because of page limitations.
VI. C ASE S TUDY
In this section, we show how an attacker can exploit
the capabilities of an extension by sending the appropriate
message. One can also find online a few videos demonstrating
the exploits on some of concerned extensions, on the Chromebrowser. In order to gain access to privileged browser features
via an extension, an attacker first needs to ensure that theextension is installed and enabled. Many recent studies discussed extensions discovery, using for instance their unique
identifiers and web accessible resources [22], [24] or DOM
specific changes they introduce in web pages [23]. This is
not really needed here. Knowing the structure of messages
extensions respond to, is sufficient. If the extension is present,
it will surely reply. To benefit from extensions capabilities, it
is sufficient that the attacker is present in a web application
with which the extension can interact.
A. Example of messages to send to extensions
We refer to Section II which presents the message passing
APIs between webpages and the different components of an
extension. Because of page limitations, we cannot provide forall extensions, the messages that can be sent from web pages
to exploit extensions capabilities. We illustrate at least eachthreat by an extension.

Execute code in content scripts context: Listing 3
present the structure of messages that can be sent from any
webpage to the jianlibao [70] Chrome extension to execute
arbitrary code in the context of its content scripts. Replace
CODE with real JavaScript code, then serialize the message
using JSON.stringify before sending it. The extension
has the storage and host permissions meaning that any
page can bypass SOP and get access to user data on any
domain, store data in the extension storage and later retrieve
it for tracking purposes. Moreover, the code is injected in theactive tab the user is interacting with. As the user may switch
tabs at any time, one can send the code regularly (say every
second) in order to ensure that it is injected in all the web
applications the user is interacting with. Since content scripts
have access to the DOM of webpages, the injected code also
has full access to the active tab DOM, giving it the ability
to undertake any action: recording user name and password,
credit card numbers, emails, etc.
{
type: "getResumeInfo", downloadObj: {resumeWhereabouts: 5}, context: {contentScript: CODE, jsMethod: "console.log"}}

Listing 3: Executing arbitrary code in the context of thecontent scripts of the current tab the user navigates to, thanks
to the jianlibao Chrome extension.
Extensions such as iwassa [54], [53] or LinkClicker [56],[55], present on Chrome and Opera, even allow to send a URL
and a code. They will open the URL in a new tab, and executethe code in the context of the content scripts injected by theextension in the new tab. Listing 4 presents the case of theiwassa extension. Replace URL with the URL of the page toopen in a new tab, and CODE with the real code to be executedin the context of the new tab content scripts.
{ from: "logininfo", val: [URL, CODE, "LoginAPI"] }Listing 4: Executing code in the context of a choosen tab
thanks to the iwassa extension present on Chrome and Opera.
URL is the URL of the page to open in a new tab, and CODE
the code to be executed.
The extension also has the host permission, allowing to make
AJAX requests to any domain.
Execute code in background page context: Backgroundpages are the most privileged contexts, as they have accessto all the capabilities of an extension. Listing 5 shows themessage to send to the Ringostat dialer [47] Chrome extension
to execute arbitrary code in the context of its backgroundpage. Interestingly, this extension has the host, storage,cookies and tabs permission, giving an attacker the ability
to bypass SOP, store data in the extension storage, manage
user cookies and tabs (open new tabs, close some, etc.).
Messages are to be sent from webpages which URLs match*://app.ringostat.com/*.
{message: "execCommand",data : {command: "eval", params: CODE}}

Listing 5: Message to send to Ringostat dialer background
page to execute arbitrary code. Replace CODE with the realcode to be executed.
Bypass SOP: Here we take the example of the Buxenger
extension, available both on Chrome and Firefox. Listing 6
shows the structure of messages to be sent to the extension inorder to make AJAX requests to any domain (SOP bypass).
The case shown here, is for making HTTP GET requests. But
the extension also allows to make AJAX requests using HTTP
POST, DELETE, PATCH methods.
{ message: "ajax-get", url: URL, callbackId: ID }Listing 6: Make arbitrary AJAX requests thanks to the
Buxenger extension present on Chrome and Firefox. Replace
URL with the URL of the data to access, and ID with any
value.
Retrieve cookies: Listing 7 shows the case of theeRail.in Chrome extension which allows any webpage toretrieve the list of user cookies.
{ Action: "GETCOOKIE" }Listing 7: Message to send to erail.in extension in orderretrieve all user cookies
This includes any cookies, such as the user authentication
cookies set after she has logged into web applications. One
can further use the cookies to mount session hijacking attacks.
The extension also allows to make arbitrary AJAX requests,
by sending messages as shown in Listing 8Store data in extension storage: Listing 10 shows
messages to send in order to store and retrieve data inthe VisualSP Training for Office 365 [72] Chrome extension
storage. Replace DATA TO STORE with the data to be stored
in the extension storage. Later on, send the second message
to retrieve data. The data will be sent to iframes in the page.
To collect the data previously stored in the extension storage,
before sending the message, one can simply add an iframeto the webpage, then send the message, collect the previously
stored data from the iframe, and send it back to the parent
page.
// Store data
{ owner: "VisualSP", command: "SetUserId",
data: DATA_TO_STORE}// Retrieve data.
{ owner: "VisualSP", command: "GetUserId" }Listing 10: Store and retrieve data in VisualSP Training for
Office 365 Chrome extension storage
History, bookmarks, extensions list: We show here thecase of the Space Galaxy HD Wallpapers [73]. It is one of
the 31 HD Wallpapers from fliptab.io (See Table III in
the appendix) that lets pages matching *.fliptab.io, to manage
user history, bookmarks, extensions list and storage. Listing 11
shows the different messages that has to be sent to get therelated information.
// Message for retrieving user browsing history{ type: "history", act: "get_all" }// Message for retrieving bookmarks{ type: "bookmarks", act: "get_all" }// Message for retrieving the list of extensions{ type: "extensions", act: "get_all" }Listing 11: The Space Galaxy HD Wallpapers Chrome
extension allows to get user browsing history, bookmarks andextension list

{ Action: "GET_BLOB", URL: URL }Listing 8: Making AJAX requests thanks to the eRail.in
Chrome extension
Downloads files: Listing 9 shows the signature of messages to send from any webpage, to the HTTP Commander [71] Chrome extension in order to trigger the downloadof any file. Replace FILE URL with the URL of the file todownload, and FILE NAME with the name under which thefile will be saved on the user device. Multiple files can besent in the message. They will all be downloaded one after
the other.
{
type: "HTCOMNET_DOWNLOAD",
files: [{url: FILE_URL, path: FILE_NAME}]}

Listing 9: Download files on the user device, thanks to the
HTTP Commander extension.

B. Forcing the attack
In order for an attacker to gain access to an extension’sAPIs, he must have a script loaded in a web application thatis allowed to interact with the extension. Moreover, in mostcases, the application has to be running in the user browser
in order for communications to be possible. Figure 4 showsa simple scenario in which A.com is an application currently
running in a user browser. This application provides content
A.com/content (a script) for another application B.com which
can communicate with an extension to get access to someprivileged APIs. However, B.com is not currently runningin the user browser. A.com can force the attack to happen,
by opening B.com (upon a user interaction with the A.com).
Once B.com runs, the script that it embeds from A.com gets
executed and can communicate with the extension to get accessto its privileged APIs — for instance to access user data on
any other application — and exfiltrate this to A.com. With theprevalence of some third party scripts providers among web

Fig. 4: A.com forces an attack by opening B.com thereby
allowing A.com/content to load, execute and interact withextensions in order to exfiltrate user data to A.com.

applications [74], this scenario can be easily implemented byattackers to gain from extensions capabilities.
Combining multiple extensions Another scenario where
access to any extension capabilities can be indirectly gained
is when some extensions make it possible to open new tabs andinject and execute arbitrary codes in them. We have recorded avideo showing the use of the LinkClicker extension [56] whichallows to open a new tab and execute code in it, and the Space
Galaxy HD Wallpapers extension [73] which allows only
fliptab.io to get/delete user browsing history, bookmarks
and extensions list. From any application (the localhost in
our example), we opened www.flipatab.io, and injected
a code in its context. The code retrieved the list of extensions,bookmarks and user history. This information could be further
sent to a server chosen by the attacker. One can even use the
LinkClicker extension to send the retrieved information backto the attacker by opening a new tab of the attacker application(localhost in our case).
VII. D ISCUSSION
Here we discuss countermeasures and proposals to mitigate
the threats introduced by extensions via message passing.
A. Disclosure to vendors
We have disclosed the list of extensions to Chrome, Firefox
and Opera. All vendors acknowledged the issues. Firefox has
removed all the reported extensions. Opera has also removed
all the extensions but 2 which can be exploited to trigger
downloads. The reason given by Opera is that the downloads
can only be triggered from specific websites. However, we
made them observe that those websites include third party
scripts that can also trigger arbitrary downloads. So discussion
still continues with Opera on the 2 remaining extensions, inparticular to ensure that users are aware of the downloads.
Chrome also acknowledged the problem in the reported extensions. We are still discussing with them on potential actions
to take: either remove or fix the extensions.
B. Proposals
The discussions with browser vendors confirmed our arguments that their current extensions review process is weak.
In fact, none of them has considered the fact that extensions
put user data at risk via vulnerabilities in the use of message passing APIs. Moreover, we are worried that malicious
extensions developers that would be aware of the ability to

exfiltrate user data via message passing, would deliberately
introduce such vulnerabilities in their extensions. There arevarious ways an extension could exploit its own vulnerabilities
without being blocked by browser vendors. For example,
the extension developer can operate a website. Then when
the user opens her browser and navigates to her favorite
web applications, the extension injects its own website as aniframe and exfiltrate user data from that iframe. For browser
vendors, a quick fix of the threats discussed in this work
is to consider message passing interfaces as a medium for
introducing vulnerabilities in extensions, thereby putting users
data at risk. New extensions must be reviewed accordingly,
in order to fix such threats. To help in this process, browser
vendors may mandate that extensions explicitly declare the listof web applications they intent to interact with by message
passing via the extensions content scripts, very similarly towhat is done with the externally_connectable key
used in extensions manifest.json files to declare the listof web applications the extension background pages intent todirectly interact with (See Section II-B).
The best solution to mitigate this threat would have been
to ban the interactions between webpages and extensions,but this would impact the many extensions making use of
these communication interfaces. Nonetheless, the needs andimplementations of the message passing interfaces are questionable. In fact, extensions can already read/write web applications DOM. For extensions that absolutely need to exchange
messages with webpages, browser vendors may review thecurrent extensions system and allow messages only from code
injected by extensions in the context of webpages. In fact,extensions can inject code directly in the context of webpages.
Currently, such code runs with the same privileges as codes
loaded by webpages themselves. We envision an architecturein which the browser tracks the origin of messages received
in extensions. And if they are not sent by code injected byextensions, the messages is not delivered to the extension.
There are surely ways an attacker can circumvent this solution,
but such attacker is exactly the one already discussed by
Carlini et al. [10] and Bandhakavi et al. [9].
C. Extensions Developers
Most of the issues we have found in extensions are imputable to extensions developers. The privileged APIs they
have access to must be used with care, as they can put atserious risks, the security and privacy of users. Most of code
execution can be avoided by properly sanitizing messages
received from web applications. To avoid leaking user information such as browsing history, extensions can manage themin extension UI pages instead of using webpages and message
passing APIs to manage them, the reason being that an attacker
script may be present on the webpage. It also seems thatsome of the SOP bypasses are the result of poor programming
practices where extensions allow SOP bypasses via message
passing for pages from their own domains in order to avoid
supporting mechanisms such as CORS [6]. Unfortunately, an
attacker script may also be present on these pages, or whenthe extension is poorly programmed, the SOP bypass could be
inadvertently enabled for all web applications.
D. Extensions Users
For users, logging out of web applications and clearing
cookies and other browsing data may limit vulnerable extensions from leaking sensitive information. Ultimately anduntil we have more trustworthy extensions APIs and tools thatprovide security and privacy guarantees about extensions, one
may also disable extensions from browsers when interactingwith sensitive web applications.
VIII. R ELATED W ORK
The security and privacy implications of browser extensions
have been extensively studied. Barth et al. [8] analyzed theFirefox XPCOM architecture and proposed a new extensions
architecture that has since been adopted by Google Chromeand evolved into the Chrome Extensions API compatible
with the cross-browser WebExtensions API. Before them,
many authors had also shown the dangers of misusing thepowerful APIs provided to Firefox XPCOM extensions andpropose tools for discovering vulnerabilities and securingextensions [7], [9], [11], [12]. Among other things, the permissions system in extensions was meant to reduce extensions
capabilities, and hence reduce the harms that attackers cancause if they compromise an extension. However a goodnumber of studies have shown that many extensions still
request too many permissions [14], [15], [16].
In this work, we focused on the WebExtensions API, across-browser extensions system compatible with Chrome,
Firefox, Opera and Microsoft Edge [1], [2], [3], [4]. Extensions go through a review process where browser vendors
track and reject malicious ones. Jagpal et al. [17] discussed thetypical malicious patterns that were concerned with extensions
review process at Chrome. Nonetheless, studies have unveiled
many malicious extensions circumventing extensions review
processes to exfiltrate sensitive user data [15], [18], [19].
Guha et al. [14] proposed IBEX a cross-browser extensions
platform, supporting fine-grained access control policies withtools for verifying the compliance with the security policies.
The work of Carlini et al. [10] on vulnerable extensions
has led to the ban of inline and HTTP scripts and eval-likefunctions in extensions background pages. Different dynamic
analysis systems have been proposed for discovering malicious
extension such as Hulk [15] and Ex-Ray [18] based on theconcept of honey pages. Starov and Nickiforakis [19] foundmany extensions leaking sensitive user information such asbrowsing history, search queries, form data and extensions list.
Recently, many studies have demonstrated different techniques
for web applications to discover extensions installed in users’
browsers for fingerprinting purposes [22], [23], [24], [25].
Other threats considered in this paper have been discussed
outside of browser extensions [75], [76], [77], [78], [21], [79],[21], [5], [61].
Calzavara et al. [13] were the first to show that message
passing interfaces could lead to privilege escalation and ex-

ploits by web applications. We discussed directly with theauthors of this work. Their goal was to formalize the privilegesthat an opponent can escalate thanks to the message passing
APIs between web applications and extensions content scripts.
In the extensions system they considered, content scripts had
no privileges and direct interactions with background pages
were not possible. They had proposed a prototype implementation of their system named CHEN for developers to evaluate
the robustness of an extension against privilege escalation andhelp them refactor their codes, but the tool is no more available
and it did not take into account long-term communications(ports).
To the best of our knowledge, this work is the first largescale study on the security and privacy implications of thecommunications between browser extensions and web applications, allowing the latter to benefit from extensions privileged
capabilities. We built a static analyzer for analyzing extensions
and identified a good number of them, demonstrating how
these extensions can be exploited by web applications tobenefit from extensions privileged capabilities and thereby
access sensitive user information.
IX. C ONCLUSION
Browser extensions are third party code in browsers withaccess to privileged APIs not accessible to web applications.
Nevertheless, web applications and browser extensions can interact with one another by exchanging messages. In this paper,
we built a static analyzer and applied it to Chrome, Firefox andOpera extensions. We identified a good number of extensions
that can be exploited by web applications to benefit fromtheir privileged capabilities. In particular, some vulnerable
extensions allow web applications to bypass the Same Origin
Policy security mechanism and access user data on any web
application. Extensions also leaked user credentials (cookies),browsing history, bookmarks, list of installed extensions, to
web applications or allowed them to download any file on
the user device, or store data in the extension storage fortracking purposes. We showed how trivially, attackers can
exploit those threats, and discussed proposals as to mitigate
them. In particular we argued for a review process taking
into consideration the threats we have discussed, with thehelp of tools such as our static analyzer, or changes in theextensions system itself to ban or limit messages only toextension injected scripts.
ACKNOWLEDGMENTS
We would like to thank the anonymous reviewers and the
PC for the quality of the comments and revision expectations
as they helped us improve the work. Special thanks to NadegeSomé, Sadry Fievet, Nataliia Bielova, and Tamara Rezk for
proof-reading, support and insightful discussions, comments
and suggestions. The author is grateful to Inria Sophia Antipolis - Méditerranée ”Nef” computation cluster for providing
resources and support. This work was supported by the project
PIA ANSWER.

R EFERENCES[1] Chrome Extensions API. [Online]. Available: https://developer.chrome.
com/extensions[2] Mozilla WebExtensions API. [Online]. Available: https://developer.
mozilla.org/en-US/Add-ons/WebExtensions[3] Opera Extensions API. [Online]. Available: https://dev.opera.com/
extensions/[4] Microsoft Edge Extensions API. [Online]. Available: https://docs.
microsoft.com/en-us/microsoft-edge/extensions[5] Same Origin Policy. [Online]. Available: https://developer.mozilla.org/
en-US/docs/Web/Security/Same-origin policy[6] Cross-Origin Resource Sharing. [Online]. Available: https://developer.
mozilla.org/en-US/docs/Web/HTTP/CORS[7] M. T. Louw, J. S. Lim, and V. N. Venkatakrishnan, “Extensible
web browser security,” in Detection of Intrusions and Malware, andVulnerability Assessment, 4th International Conference, DIMVA 2007,
Lucerne, Switzerland, July 12-13, 2007, Proceedings, ser. Lecture
Notes in Computer Science, B. M. Hämmerli and R. Sommer,
Eds., vol. 4579. Springer, 2007, pp. 1–19. [Online]. Available:
https://doi.org/10.1007/978-3-540-73614-1 1[8] A. Barth, A. P. Felt, P. Saxena, and A. Boodman, “Protectingbrowsers from extension vulnerabilities,” in Proceedings of the
Network and Distributed System Security Symposium, NDSS 2010,
San Diego, California, USA, 28th February - 3rd March 2010. The
Internet Society, 2010. [Online]. Available: http://www.isoc.org/isoc/
conferences/ndss/10/pdf/04.pdf[9] S. Bandhakavi, S. T. King, P. Madhusudan, and M. Winslett,“VEX: vetting browser extensions for security vulnerabilities,” in19th USENIX Security Symposium, Washington, DC, USA, August
11-13, 2010, Proceedings. USENIX Association, 2010, pp. 339–
354. [Online]. Available: http://www.usenix.org/events/sec10/tech/full
papers/Bandhakavi.pdf[10] N. Carlini, A. P. Felt, and D. A. Wagner, “An evaluation of
the google chrome extension security architecture,” in Proceedingsof the 21th USENIX Security Symposium, Bellevue, WA, USA,
August 8-10, 2012, T. Kohno, Ed. USENIX Association, 2012,
pp. 97–111. [Online]. Available: https://www.usenix.org/conference/
usenixsecurity12/technical-sessions/presentation/carlini[11] K. Onarlioglu, M. Battal, W. K. Robertson, and E. Kirda, “Securing
legacy firefox extensions with SENTINEL,” in Detection of Intrusions
and Malware, and Vulnerability Assessment - 10th International
Conference, DIMVA 2013, Berlin, Germany, July 18-19, 2013.
Proceedings, ser. Lecture Notes in Computer Science, K. Rieck,
P. Stewin, and J. Seifert, Eds., vol. 7967. Springer, 2013, pp. 122–138.
[Online]. Available: https://doi.org/10.1007/978-3-642-39235-1 7[12] K. Onarlioglu, A. S. Buyukkayhan, W. K. Robertson, and E. Kirda,“SENTINEL: securing legacy firefox extensions,” Computers &Security, vol. 49, pp. 147–161, 2015. [Online]. Available: https://doi.org/10.1016/j.cose.2014.12.002[13] S. Calzavara, M. Bugliesi, S. Crafa, and E. Steffinlongo, “Fine-grained
detection of privilege escalation attacks on browser extensions,” inProgramming Languages and Systems - 24th European Symposiumon Programming, ESOP 2015, Held as Part of the European Joint
Conferences on Theory and Practice of Software, ETAPS 2015, London,
UK, April 11-18, 2015. Proceedings, 2015, pp. 510–534. [Online].
Available: https://doi.org/10.1007/978-3-662-46669-8 21[14] A. Guha, M. Fredrikson, B. Livshits, and N. Swamy, “Verified security
for browser extensions,” in 32nd IEEE Symposium on Security andPrivacy, S&P 2011, 22-25 May 2011, Berkeley, California, USA.
IEEE Computer Society, 2011, pp. 115–130. [Online]. Available:
https://doi.org/10.1109/SP.2011.36[15] A. Kapravelos, C. Grier, N. Chachra, C. Kruegel, G. Vigna,
and V. Paxson, “Hulk: Eliciting malicious behavior in browser
extensions,” in Proceedings of the 23rd USENIX Security
Symposium, San Diego, CA, USA, August 20-22, 2014.,
K. Fu and J. Jung, Eds. USENIX Association, 2014, pp.
641–654. [Online]. Available: https://www.usenix.org/conference/
usenixsecurity14/technical-sessions/presentation/kapravelos[16] S. Heule, D. Rifkin, A. Russo, and D. Stefan, “The most dangerous codein the browser,” in 15th Workshop on Hot Topics in Operating Systems,
HotOS XV, Kartause Ittingen, Switzerland, May 18-20, 2015, G. Candea,
Ed. USENIX Association, 2015. [Online]. Available: https://www.
usenix.org/conference/hotos15/workshop-program/presentation/heule[17] N. Jagpal, E. Dingle, J. Gravel, P. Mavrommatis, N. Provos,
M. A. Rajab, and K. Thomas, “Trends and lessons from three
years fighting malicious extensions,” in 24th USENIX Security
Symposium, USENIX Security 15, Washington, D.C., USA, August
12-14, 2015., J. Jung and T. Holz, Eds. USENIX Association, 2015,
pp. 579–593. [Online]. Available: https://www.usenix.org/conference/
usenixsecurity15/technical-sessions/presentation/jagpal[18] M. Weissbacher, E. Mariconti, G. Suarez-Tangil, G. Stringhini,
W. K. Robertson, and E. Kirda, “Ex-ray: Detection of historyleaking browser extensions,” in Proceedings of the 33rd Annual
Computer Security Applications Conference, Orlando, FL, USA,
December 4-8, 2017. ACM, 2017, pp. 590–602. [Online]. Available:
http://doi.acm.org/10.1145/3134600.3134632[19] O. Starov and N. Nikiforakis, “Extended tracking powers: Measuring
the privacy diffusion enabled by browser extensions,” in Proceedingsof the 26th International Conference on World Wide Web, WWW
2017, Perth, Australia, April 3-7, 2017, R. Barrett, R. Cummings,
E. Agichtein, and E. Gabrilovich, Eds. ACM, 2017, pp. 1481–1490.
[Online]. Available: http://doi.acm.org/10.1145/3038912.3052596[20] Cross-Origin Communications. [Online]. Available: https://developer.
mozilla.org/en-US/docs/Web/API/Window/postMessage[21] Session Hijacking Attack. [Online]. Available: https://www.owasp.org/
index.php/Session hijacking attack[22] A. Sjösten, S. V. Acker, and A. Sabelfeld, “Discovering browser
extensions via web accessible resources,” in Proceedings of the Seventh
ACM on Conference on Data and Application Security and Privacy,
CODASPY 2017, Scottsdale, AZ, USA, March 22-24, 2017, G. Ahn,
A. Pretschner, and G. Ghinita, Eds. ACM, 2017, pp. 329–336.
[Online]. Available: http://doi.acm.org/10.1145/3029806.3029820[23] O. Starov and N. Nikiforakis, “XHOUND: quantifying thefingerprintability of browser extensions,” in 2017 IEEE Symposium on
Security and Privacy, SP 2017, San Jose, CA, USA, May 22-26, 2017.
IEEE Computer Society, 2017, pp. 941–956. [Online]. Available:
https://doi.org/10.1109/SP.2017.18[24] I. Sánchez-Rola, I. Santos, and D. Balzarotti, “Extension
breakdown: Security analysis of browsers extension resources
control policies,” in 26th USENIX Security Symposium, USENIX
Security 2017, Vancouver, BC, Canada, August 16-18, 2017.,
E. Kirda and T. Ristenpart, Eds. USENIX Association, 2017,
pp. 679–694. [Online]. Available: https://www.usenix.org/conference/
usenixsecurity17/technical-sessions/presentation/sanchez-rola[25] G. G. Gulyás, D. F. Somé, N. Bielova, and C. Castellucia, “To extend or
not to extend: on the uniqueness of browser extensions and web logins,”
in To appear in the Proceedings of the 2018 ACM on Workshop on
Privacy in the Electronic Society, WPES@CCS 2018, Toronto, Canada,
October 15 - 19, 2018, 2018.
[26] Document Object Model (DOM). https://developer.mozilla.org/en-US/
docs/Web/API/Document Object Model.
[27] Extensions
andthe
add-onID.
[Online].
Available: https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/
WebExtensions/WebExtensions and the Add-on ID[28] Browsing Contexts. https://www.w3.org/TR/html51/browsers.html.
[29] Chrome Extensions - Message Passing. [Online]. Available: https://developer.chrome.com/extensions/messaging[30] Opera - Passing Messages in Extensions. [Online]. Available:
https://dev.opera.com/extensions/message-passing/[31] A. Hidayat. ECMAScript Parsing Infrastructure. [Online]. Available:
https://www.npmjs.com/package/esprima[32] B. Newman. JavaScript Syntax Tree Transformer. [Online]. Available:
https://www.npmjs.com/package/recast[33] HTML Parser Implemented in JavaScript. [Online]. Available: https://www.npmjs.com/package/jsdom[34] SlimerJS - A scriptable browser for Web developers. [Online].
Available: https://slimerjs.org/[35] Abstract Syntax Tree. [Online]. Available: http://esprima.readthedocs.
io/en/4.0/syntax-tree-format.html#expressions-and-patterns[36] ECMAScript 2017 Internationalization API Specification (ECMA-402,
4th Edition, June 2017). https://www.ecma-international.org/ecma-402/
4.0/.
[37] Window . [Online]. Available: https://developer.mozilla.org/en-US/docs/
Web/API/Window[38] JavaScript scope. [Online]. Available: https://developer.mozilla.org/
en-US/docs/Glossary/Scope[39] JavaScript Object Property Access - Dot and Array Notation.
[Online]. Available: https://developer.mozilla.org/en-US/docs/Web/
JavaScript/Reference/Operators/Property Accessors[40] R. Wu. CRX Extension Source Viewer For Chrome, Opera, andFirefox. [Online]. Available: https://robwu.nl/crxviewer/[41] Browser
Console.
https://developer.mozilla.org/en-US/docs/Tools/
Browser Console.
[42] eEail.in Chrome extension. [Online]. Available: https://chrome.google.
com/webstore/detail/erailin/aopfgjfeiimeioiajeknfidlljpoebgc[43] Chrome Extensions. [Online]. Available: https://chrome.google.com/
webstore/category/extensions?hl=en-US[44] Opera Add-ons. [Online]. Available: https://addons.opera.com/en/
extensions/[45] Firefox Add-ons. [Online]. Available: https://addons.mozilla.org/en-US/
firefox/[46] XPCOM Interfaces. [Online]. Available: https://developer.mozilla.org/
en-US/docs/Mozilla/Tech/XUL/Tutorial/XPCOM Interfaces[47] Ringostat dialer. [Online]. Available: https://chrome.google.com/
webstore/detail/ringostat-dialer/pfofjhnkanlacmgfgjohncmgemffkldl[48] StartHQ. [Online]. Available: https://chrome.google.com/webstore/
detail/starthq/ilcpdgfepihaomggobhmfiimflngbcoh[49] SalesforceIQ CRM. [Online]. Available: https://chrome.google.com/
webstore/detail/salesforceiq-crm/jpcebpeheognnbogfkpllmmdnimjffdb[50] MegaTest - Opera Extension. [Online]. Available: https://addons.opera.com/en/extensions/details/megatest-uznat-rezultat/[51] ModernDeck - Opera Extension. [Online]. Available: https://addons.
opera.com/en/search/?query=lkdpdiepahdagdknbbjgnadholcdgfib[52] ModernDeck
ChromeExtension.
[Online].
Available:
https://chrome.google.com/webstore/detail/moderndeck/
pbpfgdgddpnbjcbpofmdanfbbigocklj[53] IWASSA - Opera Extension. [Online]. Available: https://addons.opera.
com/en/search/?query=bmjcngclkmgpfbjcmnbidognkoocpllm[54] Iwassa - Chrome Extension. [Online]. Available: https://chrome.google.
com/webstore/detail/iwassa/hnkmipajjgbclkombnmigfnpekddlhlh[55] LinkClicker - Opera Extension. [Online]. Available: https://addons.
opera.com/en/search/?query=jnmcfakfglphcmgokeeoihifcenjjcgg[56] LinkClicker
ChromeExtension.
[Online].
Available:
https://chrome.google.com/webstore/detail/linkclicker/
hoobpdoclliidciecjifpikpnopjpmkh[57] GureTV: To watch television - Firefox Extension. [Online]. Available:
https://addons.mozilla.org/en-US/firefox/addon/guretv-ver-tv/[58] LinkedIn
Sales
Navigator
ChromeExtension.
[Online].
Available:
https://chrome.google.com/webstore/detail/linkedin-sales-navigator/hihakjfhbmlmjdnnhegiciffjplmdhin[59] renren-markdown
ChromeExtension.
[Online].
Available:
https://chrome.google.com/webstore/detail/renren-markdown/
iiabjaofopjooifoclbpdmffjlgbplod[60] Telerik
TestStudioChromePlayback
2014.1.
[Online].
Available:
https://chrome.google.com/webstore/detail/telerik-test-studio-chrom/pkkbbimilpjmghfhhppamgigileopnkc[61] Http cookies. [Online]. Available: https://developer.mozilla.org/fr/docs/
HTTP/Cookies[62] multiDownloader
ChromeExtension.
[Online].
Available: https://chrome.google.com/webstore/detail/multidownloader/dnohbnpecjinmdpeikpnmheeepnapfci[63] repl.it
download
ChromeExtension.
[Online].
Available: https://chrome.google.com/webstore/detail/replit-download/
pgmcojeijjhacgkkjaakdafmloncpema[64] HD Wallpapers from fliptab.io. [Online]. Available: http://www.fliptab.
io/[65] Atavi
bookmark
manager.
[Online].
Available:
https://chrome.google.com/webstore/detail/atavi-bookmark-manager/jpchabeoojaflbaajmjhfcfiknckabpo[66] Browser History. [Online]. Available: https://chrome.google.com/
webstore/detail/browser-history/bpkphnbpiagbpinglgejckickdgaghjo[67] Boomerang for Gmail - Chrome Extension. [Online]. Available: https://chrome.google.com/webstore/detail/boomerang-for-gmail/mdanidgdpmkimeiiojknlnekblgmpdll[68] ISOGG Y-Tree AddOn - Chrome Extension. [Online]. Available:
https://chrome.google.com/webstore/detail/isogg-y-tree-addon/
cfnjeahambijfdljfacldifapdcklhnj[69] PhyloTreeMT AddOn - Chrome Extension. [Online]. Available:
https://chrome.google.com/webstore/detail/phylotreemt-addon/
ilpkhojfiejdbkgcjbmllngjebdoehim[70] jianlibao
ChromeExtension.
[Online].
Available:
https://chrome.google.com/webstore/detail/jianlibao/
fimckmjeammfdcpldmcigeojkkmeeian[71] HTTP Commander - Chrome Extension.
[72] VisualSP
Training
for
Office365
ChromeExtension. [Online]. Available: https://chrome.google.com/webstore/detail/visualsp-training-for-off/ohdihpdgfenligmhnmldmiabdhflokkh[73] Space
GalaxyHD
Wallpapers
ChromeExtension. [Online]. Available: https://chrome.google.com/webstore/detail/space-galaxy-hd-wallpaper/dkpndikhfepllbpaafgcelembimabofo[74] N. Nikiforakis, L. Invernizzi, A. Kapravelos, S. V. Acker, W. Joosen,
C. Kruegel, F. Piessens, and G. Vigna, “You are what you include:
large-scale evaluation of remote javascript inclusions,” in the ACM
Conference on Computer and Communications Security, CCS’12,
Raleigh, NC, USA, October 16-18, 2012, T. Yu, G. Danezis, andV. D. Gligor, Eds. ACM, 2012, pp. 736–747. [Online]. Available:
http://doi.acm.org/10.1145/2382196.2382274[75] F. Roesner, T. Kohno, and D. Wetherall, “Detecting and defending
against third-party tracking on the web,” in Proceedings of the 9th
USENIX Symposium on Networked Systems Design and Implementation,
NSDI 2012, San Jose, CA, USA, April 25-27, 2012, S. D. Gribble and
D. Katabi, Eds. USENIX Association, 2012, pp. 155–168. [Online].
Available: https://www.usenix.org/conference/nsdi12/technical-sessions/presentation/roesner[76] J. R. Mayer and J. C. Mitchell, “Third-party web tracking: Policy
and technology,” in IEEE Symposium on Security and Privacy,
SP 2012, 21-23 May 2012, San Francisco, California, USA.
IEEE Computer Society, 2012, pp. 413–427. [Online]. Available:
http://dx.doi.org/10.1109/SP.2012.47[77] S. Englehardt and A. Narayanan, “Online tracking: A 1-million-sitemeasurement and analysis,” in Proceedings of the 2016 ACM SIGSAC
Conference on Computer and Communications Security, Vienna, Austria,
October 24-28, 2016, E. R. Weippl, S. Katzenbeisser, C. Kruegel, A. C.
Myers, and S. Halevi, Eds. ACM, 2016, pp. 1388–1401. [Online].
Available: http://doi.acm.org/10.1145/2976749.2978313[78] A. Lerner, A. K. Simpson, T. Kohno, and F. Roesner, “Internet
jones and the raiders of the lost trackers: An archaeologicalstudy of web tracking from 1996 to 2016,” in 25th USENIX
Security Symposium, USENIX Security 16, Austin, TX, USA,
August 10-12, 2016., T. Holz and S. Savage, Eds. USENIX
Association, 2016. [Online]. Available: https://www.usenix.org/
conference/usenixsecurity16/technical-sessions/presentation/lerner[79] M. Johns, “Session hijacking attacks,” in Encyclopedia of Cryptography
and Security, 2nd Ed., H. C. A. van Tilborg and S. Jajodia,
Eds. Springer, 2011, pp. 1189–1190. [Online]. Available: https://doi.org/10.1007/978-1-4419-5906-5 661

TABLE III: Extensions with the same code base which gives*.fliptab.io access to browsing history (get/delete), bookmarks(get), extensions (get/enable/disable/uninstall) and storage
bddmmehmgpjhhmbbmngdjhlednmkbken, cajmbfbhhfelhgolhldhhodkclpakcfe
cepmfckfppjpbkjgnpokojedlngflnca, clkodoejadlbjaopcjoijihebbgipjff
dekpebffaadijeaogggfhjemdbjgbcao, dkpndikhfepllbpaafgcelembimabofo
eeiedbnahjonkmimigblgchlefcklhok, efdddbobcofamdjmekphjlhgmcnhobbp
ehmhopjniedignnkdeijmpmodhcppgif, eilbnnflfpkhhfmhmlhflhecceajpkcj
fieoemdbopiialnojhifcndkenhjkbmm, fkpmpnljocdllgmplhnmjhjmmilbnofj
gfgchcclfmppnfoakdlhgdhnolbpiedf, glfbbjdfmmlanpikdedpjoeimlijjcjj
hmbedbiicehadpbhbipafffieolpjolh, hocncjdhccalpmblkpagbmjebkfkibbm
iamlligjelallbdddajmbojjjhadkmcf, jcffnpjkbahanenhcnhhdfopkjlpflfm
jokpapkhjeahjbkemfjfhjgcogmbcpoi, kkejopfphkmldfpdmcljfoinfcljijjf
klfeojnepdoehgddffbcjiamcjjahmgj, lbfidebeingoondbmpeapjoeeoloanak
lgphbplfjpemcghfcoajehcmikflcbbd, lmbcpiodajlbgmjbiajgcjdalgbofcbn
loggojfoonblkkhkjpijapeheoogagki, lpkfidfkgflpbakdnhpojiejlpdanknh
mgmodhbknbfmpjmilankiffnjbelcipo, mibaeahdcconphmdndbeipegldkkbcjh
odpiaedkmdpcheddbkilnkelhhocoenn, pfdaccgdljiifplhfnjcacapfedngonb
afddmpnodjaifgjibafjcbfaplnoipei

TABLE IV: Extensions with the same code base for triggering downloads from vk.com, *.vimeo.com, *.coub.com,*.kinopoisk.ru
nfhipbkhabgmkhahoaagkcgppcjikjgl idenapkfefkbknhbmfgeaclpcpbhcnbe
fnnlocjimhjpmgfjhjamdkjhemfhkhjo lmlnplkfbiihcpkghkkmfefjdaccmbcc
kbiocjbkoohjjkkeaafiemjeidgalllh dccmnjciogmmahaogjgkocongokmieog
ekfkljjojhnnhfedepfnbhhfjklagngk hhfgpbjpilbbaomjmdpnfchbpipehiif
pgajmafmbajahclonccaoaoleghhnpam ipeeopcjpgcbgnfogjlickeilmkbonen
jfpmehlefcchhhmlmennihbbihaolabk kcollknpphnodcjdkcmgpjmlbaenabao
backekeabechifnekobfachchocbmjag mfpbgndgoogfplejodpbhnfmaibnalkf
ojhheobonaamlhlcdngacakdcigpeokl mienmjdbnnpaigifneeiifdbjkdgelhaamaobfendgcolppeioeageanmillkmkc

TABLE V: Extensions with the same code base which leaks
topsites, history and/or bookmarks to *.atavi.com, *.atavi.test
iglbnbabjdfaobglhonmnlkdbommiebd, knflcnelciofoghldagpknelepafjeif
lamnafpjcnoclihgpefhdbefcmjikhaj, jffjjdoccjiflmckicphblggbppfgklk
ofmacdiceehcibkfednmgpkhgfhpacgi, jpchabeoojaflbaajmjhfcfiknckabpo

TABLE VI: Extensions with the same code base, provided by
Fabasoft, which give access to the current tab cookies
ajlbdflhaaflcepndpkdgejimggjcpnm, ngbcdblbfdpjgpmgfagkfofcjbnggfgn
pdhjoolhbkmlgjfedckdhiknnoabbnkk, hiejidhjgjpelfgldfhmnaoahnephhfg
icjlkccflchmagmkfidekficomdnlcig

TABLE VII: Extensions which give access to their storage to
any applicationeljhpoopiapggnlfcilpbihgbgbpnkgd, akhamklknibionleflabebgeikdookmp
hebabhddakflgmlhgefakkfkciijliie, ilgdjidfijkaengnhpeoneiagigajhco
ohdihpdgfenligmhnmldmiabdhflokkh, abenhehmjmoifipfpjeaejpbeeihnokp
ackpndpapmikcoklmcbigfgkiemohddk, ceogcehidijhepckebfifkpfogkajdkg
cgijoonmpaboophnagdckdcekmpfokel, dhcfokhhmhenbfmeflifppiedabfggkj
dhcmolikocplmafolinkncghmahimooh, eamjolanjdmgochipodfokkfjaeifhon
efhbachoakbcmbcmfffdgphbpcbldjac, fecipnolpdcmoidbjbnakpjgfikbnaik
gnnagpehbmfalanfjadamobejlldgedo, ijdfpccaiklfhpnamolipbjjijilmhli
khjhfgcimhcnaimdbgjbnbhcojkoceoc, niceocbendibobemckcagggppphheomc
okcfiidnmioajibmhhjpiomgejajiafa, pjjceionkajpednnegoanjjdlhbgkkpc
pjojmkmdealampgchopkfbejihpimjia,

TABLE VIII: Extensions which give access to their storage to
specific applications
lpkhcobfjeidpkllbeagkkmmjgbmpfch
eggdmhdpffgikgakkfojgiledkekfdce
jmllflbhbembffempimjdbgnaodpoihh
jmlnhlclbpfcbkaoaegfigepaffoankc
gaoiiiehelhpkmpkolndijhiogfholcc
ghldlmcbffbcnoofadgcapodmpiimflj
jpgadigdffhcjldfkanacncocacekkie
peiajekggpiihnhphljoikpjeaahkdcn
bnfboihohdckgijdkplinpflifbbfmhm
aclhfmpoahihmhhacaekgcbjaeojnifa
hcdfoeppbchkbbpplllggbjkkfokifej
hddnlanhlmifafibmlabomkkkobcmchj
lhjajgnfmiliphkioedlmbfcdkhdhnkc
bmdlalnebjigindhobniianfmhakfelf
dadggmdmhmfkpglkfpkjdmlendbkehoh
pbpfgdgddpnbjcbpofmdanfbbigocklj
ilpkhojfiejdbkgcjbmllngjebdoehim
cfnjeahambijfdljfacldifapdcklhnj
cjkbjhfhpbmnphgbppkbcidpmmbhaifa
ddiaadobgihkgefcaajmkjgmnjakiamn
dienbdhbgkpddlgaceopelifcjpmkeha
dnpdkejhfeeipmklhlkdjaoakbkjkkjn
gmjdaaahidcimfaipifeoekglllgdllb
kfodnoaejimmmphonklghkimhnhhgbce

mail.google.com
mail.google.com
mail.google.com*.google.com,
netflix.com
netflix.com
netflix.com/watch/beam.proplug.dj
wordix.io,*.vk.com/feed/
thankscoin.org*.service-now.com
robertsspaceindustries.com,
openvideo.droppages.com
tweetdeck-enhancer*.phylotree.org
isogg.org*.player.me
auth.digitalkeyway.com*.gestionderesidencias.es
datalane.io
chat.stackexchange.com
overlayBI.com

TABLE IX: Chrome, Firefox and Opera extensions which give web applications access to privileged APIs
Extension unique identifier or namefimckmjeammfdcpldmcigeojkkmeeian
fidaihkgnbcbkkdaoebdionfjenegede
hnkmipajjgbclkombnmigfnpekddlhlh
fajjnmbcianlnhmngmabhgkmgdindlha
efajnkcfjjkcodbhkhaigkffdleomnag
hoobpdoclliidciecjifpikpnopjpmkh
kjfjdocojijlledbaanbhpcnkoimghal
pfofjhnkanlacmgfgjohncmgemffkldl
gooecknlakggnppmhfpopneedjconjjp
bdiogkcdmlehdjfandmfaibbkkaicppk
pgbjjemkcflenaakhiehfdmcdnlnlpbl
hdanmfijddamndfaabibmcafmnhhmebi
hpmeebiiihmjelpjmmemlihhcacflflc
oejnkhmeilmiplpmenkegjaibnjbappojkoegdibpkleifbkojmplebjhfllkckn
aopfgjfeiimeioiajeknfidlljpoebgc
hlagecmhpppmpfdifmigdglnhcpnohib
kpgdinlfgnkbfkmffilkgmeahphehegk
bjjpnhdlhpfdebcbhdlmecafnokpjpce
bmiedopcajpcehbbfglefijfmmndcaoa
jegnjmcegcpodciadcoeneecmkiccfgi
jnhibbjmekoijdjaopflcjbjieamifhh
jpkfmllgncphdgojhkbcjidgeabaible
ilcpdgfepihaomggobhmfiimflngbcoh
jpcebpeheognnbogfkpllmmdnimjffdb
cnkgdfnjmgamkcpjdljdncfjcegpgcdg
cfddhmlokgokhcmepddjooekhmgmgfld
efhgmgomhamkkmjbgmcpgjnabcfpnaek
djhfcchmdelggndcpkgbanfhnpbbijdb
fhlkioimlijffnblckmdikkadobdmlgn
angncidddapgcmohkdmhidfleomhmfgi
lndhlcaobijohmgoikmgpgbhepkbhpkl
olpheomfiimdonpboopcailehdagfhaa
idkghekmllmjgnmbohakcddgcclanlca
mhdhcccejcjfanablmohbpdbepdkokkj
plfffminkgohddbooidppccppgelajfp
cboekbiaoabkhgjdclenjpipclabkdga
ekeefjfdbaakgbfbagacmckiedkmakem
lbjbbkhljiimahdeknpckaoiinopofhl
ijmbknjhacbaeeoamjajoolgjgdbpkko
hihakjfhbmlmjdnnhegiciffjplmdhin
cfbodcmobhpfbjhbennacnanbmpbcfkd
ommfijfafanajffiijecdlfjlbgpmgpl
okgfglgogpkomipfflpajohdkaflndoh
iiabjaofopjooifoclbpdmffjlgbplod
mcdjehgaflnlmilhefigdkldfdnembhk
lfekjajdgncmkajdpiadkkhhpblngnlc
gkfpnohhmkonpkkpdbebccbgnajfgpjp
pkkbbimilpjmghfhhppamgigileopnkc
5 Fabasoft extensions (See Table VI)
emiplbkkiabideffmpogkbbogkmofgph
17 extensions (See Table IV)
eadbjnlpeabhbllkljhifinhfelhimha
ngegklmoecgejlbkiieccocmpmpmfhim
iogibhaacmieogkdgebfbjgoofdlcmgb
ooeealgadmhdnhebkhhbbcmckehpomcj
dnohbnpecjinmdpeikpnmheeepnapfci
pgmcojeijjhacgkkjaakdafmloncpema
hacopcfnbokiahlppemnlneooamldola
bpkphnbpiagbpinglgejckickdgaghjo
fheihcbdclkdoeadmjfggiamjgkippli

Web applications to Target web applicasend messages fromtions to access
Chrome Browser
*
*
*
*
*
*
*
*
*
*
*
*
*
*
app.ringostat.com*
lionlock.com,**.delfa.com.br*
www.seejay.cloud**.hirogete.com,**.valleyge.com*
search.lilo.org,*
search.uselilo.org,
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
starthq.com,*
mail.google.com,*
mail.google.com,**.ok.ru**.ok.ru**.ok.ru**.apistop.com*
logincat.com,*
oneom.tk*.g3user.com,
*
ln.io
*
*.gvt.com.br,*
mp.weixin.qq.com,**.apiary.io,**.salesmate.io,
mail.google.com,*.appspot.com
mail.google.com,*.aliexpress.com,*.google.com,
mail.google.com
linkedin.com,*.aliexpress.com,
appfreaker.com*.treesnetwork.com,
docs.google.com,
ouramazinghome.com
www.google.com
blog.renren.com*.github.com*.spotsetter.com*.amazonaws.com
sub.watch,
zooqle.com,
squares.io/fetch,www.nytimes.com***
current tab*
vk.com,ok.ru*.tribecube.com*.shutterstock.com
animevost.org
vtop.vit.ac.in
repl.ithypem.com
amer...matrix.com.my-lucky-star.net-

Permissions (accessible privileged API)eval, host, storage, downloads
eval, host, storage
eval, host, storage
eval, host, storage
eval, hosteval, hosteval, hosteval, host, cookies, storage
eval, host, storage
eval, host, storage
eval, host, storage
eval, hosteval, hosteval, hosteval, host
host, cookies
host
host
host
host
host
host
host
host, history
host, management
host, management
host, downloads
host, downloads
host, downloads
host
host
host
host
host
host
host
host
host
host
host
host
host
host
host
host
host
host
host
cookiescookiesdownloads
downloads
downloads
downloads
downloads
downloads
downloads
downloads
downloads
history
topSitesTABLE IX: Chrome, Firefox and Opera extensions which give web applications access to privileged APIs
Extension unique identifier or namellelondjpcjljnjihdflhpclcpbiaiba
6 Atavi Extensions (See Table V)
31 HD Wallpapers (See Table III)
pnbfclligibfgdknphcodpbcejnkhffp
eihbcgffjehfcgafjljohecmadcefoji
empgohlokhdhhchkenknobacofijiffg
aefmgkhgcmdljpfijlohmbhkhflmbmfi
dhjhphjhpcelebeagllljbfpipdfkhgi
jeabbgpkliknjiacfkfglknajloappkh
22 Extensions (See Table VII)
24 Extensions (See Table VIII)
guretv-ver-tv
buxenger
bitbucket-server
logincataddon
facebook-photo-zoom-easy
facebook-photo-zoom
markanabak-eklentisi
skimdaddy
the-trees-network
assina-me
liber-capital
video-downloader-1
openvost
youtube-video-download-convert
openvideo
vgis
bmjcngclkmgpfbjcmnbidognkoocpllm
jnmcfakfglphcmgokeeoihifcenjjcgg
pmpnemphhmmpkcafgpdjanghiaadfbef
mpaghnpkgmnikepcgjddhckcedapomkp
bcabkcaakkjfdlodkolfagbdejhhkigp
bidjmocompdljmeglljcoecikgogfjbb
aghgmcnoiflhcnfjkckofmjbeinjkena
mhjbdafcpnoapkglmldoofhhbpnogehk
hajlecmoacenahambneialopbpleihjn
lkdpdiepahdagdknbbjgnadholcdgfib

Web applications to Target web applicasend messages fromtions to access
Chrome Browser*.msn.com
atavi.com,
fliptab.io*
app.launch.menu
app.launch.menu
openoox.com.azurewebsites.net
yeahap.com,*
mail.google.com, ...
Firefox Browser
*
*
*
*
*
*
logincat.com,*
www.facebook.com*
www.facebook.com**.markanabak.com,*.wipo.int,*
skimdaddy.com*.treesnetwork.com,
docs.google.com,***
animevost.org*.youtube.com
droppages.com*.vonage.com
Opera Browser*****.ok.ru**.ok.ru, *.vk.com,**.lazyrobin.ru*
sub.watch,
zooqle.com,
vk.com,vk.com,*tweetdeck-enhancer-

Permissions (accessible privileged API)

topSiteshistory, bookmarks, topSites
history, bookmarks, management,
storagebookmarks
bookmarks
bookmarks
bookmarks
bookmarks
bookmarks
storagestorageeval, host, storage
eval, host
host
host
host
host
host
host
host
downloads
downloads
downloads
downloads
downloads
storagestorageeval, host, storage
eval, host
host
host
host
host
downloads
downloads
storagestorage