Gandalf_The_Grey
Level 83
Thread author
Verified
Honorary Member
Top Poster
Content Creator
Well-known
- Apr 24, 2016
- 7,345
Browser extensions have long been a convenient tool for users, enhancing productivity and streamlining tasks. However, they have also become a prime target for malicious actors looking to exploit vulnerabilities, targeting both individual users and enterprises.
- Research shows that Manifest V3 could suffer from security issues
- The upgraded Chromium manifest still allows malicious extensions
- Some security tools struggle to identify dangerous extensions
Despite efforts to enhance security, many of these extensions have found ways to exploit loopholes in Google’s latest extension framework, Manifest V3 (MV3).
Recent research by SquareX has revealed how these rogue extensions can still bypass key security measures, exposing millions of users to risks such as data theft, malware, and unauthorized access to sensitive information.
Google has always struggled with the issues of extensions in Chrome. In June 2023, the company had to manually remove 32 exploitable extensions that were installed 72 million times before they were taken down.
Google’s previous extension framework, Manifest Version 2 (MV2), was notoriously problematic. It often granted excessive permissions to extensions and allowed scripts to be injected without user awareness, making it easier for attackers to steal data, access sensitive information, and introduce malware.
In response, Google introduced Manifest V3, which aimed to tighten security by limiting permissions and requiring extensions to declare their scripts in advance. While MV3 was expected to resolve the vulnerabilities present in MV2, SquareX’s research shows that it falls short in critical areas.
Malicious extensions built on MV3 can still bypass security features and steal live video streams from collaboration platforms like Google Meet and Zoom Web without needing special permissions. They can also add unauthorized collaborators to private GitHub repositories, and even redirect users to phishing pages disguised as password managers.
Furthermore, these malicious extensions can access browsing history, cookies, bookmarks, and download history, in a similar way to their MV2 counterparts, by inserting a fake software update pop-up that tricks users into downloading the malware.
Once the malicious extension is installed, individuals and enterprises cannot detect the activities of these extensions, leaving them exposed. Security solutions like endpoint protection, Secure Access Service Edge (SASE), and Secure Web Gateways (SWG) cannot dynamically assess browser extensions for potential risks.
Google Chrome extensions remain a security risk as Manifest V3 fails to prevent data theft and malware exploitation
Businesses should look to implement stronger browser security measures
www.techradar.com