The experts released a beta version of the CRXcavator allows to analyze the permissions associated with Chrome extensions, along with many other features, and their implications.
Extensions have access to powerful functionality within the context of a browser that could be abused by threat actors, for this reason, it is important for end-user to discover malicious Chrome extensions and legitimate, benign extensions affected by security issues.
“The set of permissions an extension
“We have categorized and assigned an objective numerical risk score to each permission to help a security team have a metric to use when triaging extension analysis,”.
“With all these perspectives included, a CRXcavator report equips a security operations analyst to make a well-informed decision about whether to allow or block an extension,” continues Duo Labs.
Most of the extensions in the Web Store that support Content Security Policies (99%) do not have default-src or connect-src in the CSP defined (these allow developers restrict the external resources the extension can access). Experts pointed out that 78.3% of them do not have a CSP defined,
(SecurityAffairs – Chrome extensions, hacking)
Necessary cookies are absolutely essential for the website to function properly. This category only includes cookies that ensures basic functionalities and security features of the website. These cookies do not store any personal information.
Any cookies that may not be particularly necessary for the website to function and is used specifically to collect user personal data via analytics, ads, other embedded contents are termed as non-necessary cookies. It is mandatory to procure user consent prior to running these cookies on your website.