Whitelisting extensions in Edge
Malicious extensions are pretty popular in the wild. Here are some examples of their malicious activities:
www.kaspersky.com
Whitelisting extensions in the web browser prevents installing malicious (unwanted) extensions by casual users or by malware running outside the web browser.
It can be done by applying Edge Policies ("BlockExternalExtensions, ExtensionInstallAllowlist, ExtensionInstallBlocklist)
The ExtensionInstallAllowlist contains the IDs of whitelisted extensions (others are blocked). For example, the ID "pdffkfellgipmhklpdmokmckkkfcopbh" is related to AdGuard AdBlocker, which can be identified on the microsoftedge.microsoft.com:
https://microsoftedge.microsoft.com/addons/detail/adguard-adblocker/pdffkfellgipmhklpdmokmckkkfcopbh
The extension IDs can also be found in the folder:
%LocalAppData%\Microsoft\Edge\User Data\Default\Extensions\
%LocalAppData%\Microsoft\Edge\User Data\Profile 1\Extensions\
%LocalAppData%\Microsoft\Edge\User Data\Profile 2\Extensions\
To view the policies, open Microsoft Edge and enter edge://policy in the address bar.
Here is an example of blocked installation:
Malicious extensions are pretty popular in the wild. Here are some examples of their malicious activities:
- Bypassing two-factor authentication.
- Sending the victim’s correspondence to the hackers’ C2 server.
- Stealing cryptocurrency.
- Spoofing search results with ADs.
- Hijacking accounts in games and social networks.
Malicious browser extensions in 2023
Stealing cryptocurrency, hijacking accounts in games and social networks, manipulating search results, and other dirty tricks of malicious browser extensions in 2023.
www.kaspersky.com
Whitelisting extensions in the web browser prevents installing malicious (unwanted) extensions by casual users or by malware running outside the web browser.
It can be done by applying Edge Policies ("BlockExternalExtensions, ExtensionInstallAllowlist, ExtensionInstallBlocklist)
Code:
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Edge]
"BlockExternalExtensions"=dword:00000001
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Edge\ExtensionInstallAllowlist]
"1"="cnlefmmeadmemmdciolhbnfeacpdfbkd"
"2"="ghbmnnjooekpmoecnnnilnnbdlolhkhi"
"3"="jbkfoedolllekgbhcbcoahefnbanhhlh"
"4"="pdffkfellgipmhklpdmokmckkkfcopbh"
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Edge\ExtensionInstallBlocklist]
"1"="*"The ExtensionInstallAllowlist contains the IDs of whitelisted extensions (others are blocked). For example, the ID "pdffkfellgipmhklpdmokmckkkfcopbh" is related to AdGuard AdBlocker, which can be identified on the microsoftedge.microsoft.com:
https://microsoftedge.microsoft.com/addons/detail/adguard-adblocker/pdffkfellgipmhklpdmokmckkkfcopbh
The extension IDs can also be found in the folder:
%LocalAppData%\Microsoft\Edge\User Data\Default\Extensions\
%LocalAppData%\Microsoft\Edge\User Data\Profile 1\Extensions\
%LocalAppData%\Microsoft\Edge\User Data\Profile 2\Extensions\
To view the policies, open Microsoft Edge and enter edge://policy in the address bar.
Here is an example of blocked installation:
